General
-
Target
Ransomware.Thanos.zip
-
Size
145KB
-
MD5
00184463f3b071369d60353c692be6f0
-
SHA1
d3c1e90f39da2997ef4888b54d706b1a1fde642a
-
SHA256
cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787
-
SHA512
baa931a23ecbcb15dda6a1dc46d65fd74b46ccea8891c48f0822a8a10092b7d4f7ea1dc971946a161ac861f0aa8b99362d5bea960b47b10f8c91e33d1b018006
-
SSDEEP
3072:fn8L7y+NJQpRhkU0kbH2PNo/1GjTqOncYIOSsk:f8L7xNJQFzCo/ojTqOnYD
Score
10/10
Malware Config
Signatures
-
Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Thanos executable 2 IoCs
-
Thanos family
-
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
Files
-
Ransomware.Thanos.zip
Password: infected
-
58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections
-
5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections
-
ae66e009e16f0fad3b70ad20801f48f2edb904fa5341a89e126a26fd3fc80f75
Headers
Sections
-
c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections