thanos | cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787

Sharing

Copy URL

Twitter E-mail

General

Target

Ransomware.Thanos.zip
Size

145KB
Sample

240914-176mvszepe
MD5

00184463f3b071369d60353c692be6f0
SHA1

d3c1e90f39da2997ef4888b54d706b1a1fde642a
SHA256

cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787
SHA512

baa931a23ecbcb15dda6a1dc46d65fd74b46ccea8891c48f0822a8a10092b7d4f7ea1dc971946a161ac861f0aa8b99362d5bea960b47b10f8c91e33d1b018006
SSDEEP

3072:fn8L7y+NJQpRhkU0kbH2PNo/1GjTqOncYIOSsk:f8L7xNJQFzCo/ojTqOnYD

Score

10^/10

Malware Config

Targets

- Target
  
  58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f
- Size
  
  82KB
- MD5
  
  e01e11dca5e8b08fc8231b1cb6e2048c
- SHA1
  
  4983d07f004436caa3f10b38adacbba6a4ede01a
- SHA256
  
  58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f
- SHA512
  
  298bfb9fe55ddd80f1c6671622d7e9e865899a855b5bb8e0d85d8520160cedca6fd8bc72c9881925477bcab883bf6e6f4c69f997b774b74fe992e023a81269de
- SSDEEP
  
  1536:PcW4lAJGGnzjoih/NDh/NDuk+XkGAK/hztXcag+PlbBfkWIyvZrw281r5XsmCZEe:UWNGszjoih/NDh/NDuk+XkGAK/hztXcQ
Score

10^/10

defense_evasion evasion persistence ransomware discovery execution impact trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Disables service(s)
  evasion execution
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (56) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Blocklisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Windows security modification
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Modifies WinLogon
  persistence
behavioral1 behavioral2
- Target
  
  5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d
- Size
  
  91KB
- MD5
  
  be60e389a0108b2871dff12dfbb542ac
- SHA1
  
  14b4e0bfac64ec0f837f84ab1780ca7ced8d670d
- SHA256
  
  5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d
- SHA512
  
  6051bec441434a80c34ee2752a3da9c3a0307cd1b551aa27a0f7f6f75b9bf64b172745d80f03eea054a03ebd2c493df21fd48d8fa3b706d46a6f7fee0e7c0641
- SSDEEP
  
  1536:QguHLgeS6umiCp31W4qYXgsLlOqrgB9GpF7LXdarTkCAKL5dsluhtvM4CoLT6QPg:D6seqCp31Hgsp9a9GTrda8CAKLTsWkyI
Score

10^/10

defense_evasion discovery evasion execution impact ransomware
- Disables service(s)
  evasion execution
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (82) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops startup file
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Legitimate hosting services abused for malware hosting/C2
behavioral3 behavioral4
- Target
  
  ae66e009e16f0fad3b70ad20801f48f2edb904fa5341a89e126a26fd3fc80f75
- Size
  
  100KB
- MD5
  
  03b76a5130d0df8134a6bdea7fe97bcd
- SHA1
  
  60053d661ed03cd2a07f6750532e6ef11abcc4e5
- SHA256
  
  ae66e009e16f0fad3b70ad20801f48f2edb904fa5341a89e126a26fd3fc80f75
- SHA512
  
  d82eb0858819fc50b28910dfe8d537c8e7b0f34bc8953e48e7799b55ffe9320775df38c0ae38420808a0ddd84ea0d0c6b989b4348fcac52bbf2d1af7777091b8
- SSDEEP
  
  3072:P6seqCp31Hgsp9a9GTrda8CAKLTsWkyc:CqCp31Z9a9GTrk8CV/t
Score

1^/10
behavioral5 behavioral6
- Target
  
  c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850
- Size
  
  87KB
- MD5
  
  d6d956267a268c9dcf48445629d2803e
- SHA1
  
  cc0feae505dad9c140dd21d1b40b518d8e61b3a4
- SHA256
  
  c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850
- SHA512
  
  e0791f6eb3116d0590be3af3713c94f787f7ced8e904d4bb8fc0d1341f332053414cb1e9095ae2de041b9e6d6d55cf773bf45ebeb74f27bb95c11a3cc364abee
- SSDEEP
  
  1536:OXMLuZQG3KJ3QaIH9shR4fZcvr4C9u3MTIdD9mtthd9JovrgmqhtvM4CoLT6QPbc:gMLuZraJ3a0ehcvv9sM+9mtthd0gmWkr
Score

10^/10

defense_evasion evasion execution impact persistence ransomware trojan discovery
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Disables service(s)
  evasion execution
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (51) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Blocklisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Windows security modification
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Modifies WinLogon
  persistence
behavioral7 behavioral8