Ransomware.Thanos.zip
- SHA256 cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787
Password
infected
Overview
overview
10Static
static
1058bfb9fa88...1f.exe
windows10-2004-x64
1058bfb9fa88...1f.exe
windows11-21h2-x64
105d40615701...3d.exe
windows10-2004-x64
105d40615701...3d.exe
windows11-21h2-x64
10ae66e009e1...75.exe
windows10-2004-x64
ae66e009e1...75.exe
windows11-21h2-x64
c460fc0d4f...50.exe
windows10-2004-x64
10c460fc0d4f...50.exe
windows11-21h2-x64
10Behavioral task
behavioral1
Sample
58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f.exe
Resource
win11-20240802-en
windows11-21h2-x64
24 signatures
150 seconds
Behavioral task
behavioral3
Sample
5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral4
Sample
5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
Resource
win11-20240802-en
windows11-21h2-x64
19 signatures
150 seconds
Behavioral task
behavioral5
Sample
ae66e009e16f0fad3b70ad20801f48f2edb904fa5341a89e126a26fd3fc80f75.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
ae66e009e16f0fad3b70ad20801f48f2edb904fa5341a89e126a26fd3fc80f75.exe
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral8
Sample
c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
Resource
win11-20240802-en
windows11-21h2-x64
22 signatures
150 seconds
General
- Target Ransomware.Thanos.zip
- Size 145KB
- Sample240915-2xrlmaxdjj
- SHA256 cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787
- MD5 00184463f3b071369d60353c692be6f0
- SHA1 d3c1e90f39da2997ef4888b54d706b1a1fde642a
- SHA512 baa931a23ecbcb15dda6a1dc46d65fd74b46ccea8891c48f0822a8a10092b7d4f7ea1dc971946a161ac861f0aa8b99362d5bea960b47b10f8c91e33d1b018006
- SSDEEP 3072:fn8L7y+NJQpRhkU0kbH2PNo/1GjTqOncYIOSsk:f8L7xNJQFzCo/ojTqOnYD
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule static1/unpack001/58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f disable_win_def static1/unpack001/c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850 disable_win_def - Thanos executable 2 IoCs
resource yara_rule static1/unpack001/58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f family_thanos_ransomware static1/unpack001/c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850 family_thanos_ransomware - Thanos family
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f unpack001/5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d unpack001/ae66e009e16f0fad3b70ad20801f48f2edb904fa5341a89e126a26fd3fc80f75 unpack001/c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850
File Explorer
-
Ransomware.Thanos.zip.zip 145KB
-
58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f.exe 82KB
-
5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe 91KB
-
ae66e009e16f0fad3b70ad20801f48f2edb904fa5341a89e126a26fd3fc80f75.exe 100KB
-
c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe 87KB
58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f
- MD5 e01e11dca5e8b08fc8231b1cb6e2048c
- SHA1 4983d07f004436caa3f10b38adacbba6a4ede01a
- SHA512 298bfb9fe55ddd80f1c6671622d7e9e865899a855b5bb8e0d85d8520160cedca6fd8bc72c9881925477bcab883bf6e6f4c69f997b774b74fe992e023a81269de
- SSDEEP 1536:PcW4lAJGGnzjoih/NDh/NDuk+XkGAK/hztXcag+PlbBfkWIyvZrw281r5XsmCZEe:UWNGszjoih/NDh/NDuk+XkGAK/hztXcQ
- MD5 SHA1 SHA512 SSDEEP
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Thanos executable
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
89774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d
- MD5 be60e389a0108b2871dff12dfbb542ac
- SHA1 14b4e0bfac64ec0f837f84ab1780ca7ced8d670d
- SHA512 6051bec441434a80c34ee2752a3da9c3a0307cd1b551aa27a0f7f6f75b9bf64b172745d80f03eea054a03ebd2c493df21fd48d8fa3b706d46a6f7fee0e7c0641
- SSDEEP 1536:QguHLgeS6umiCp31W4qYXgsLlOqrgB9GpF7LXdarTkCAKL5dsluhtvM4CoLT6QPg:D6seqCp31Hgsp9a9GTrda8CAKLTsWkyI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
97918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ae66e009e16f0fad3b70ad20801f48f2edb904fa5341a89e126a26fd3fc80f75
- SHA256 ae66e009e16f0fad3b70ad20801f48f2edb904fa5341a89e126a26fd3fc80f75
- MD5 03b76a5130d0df8134a6bdea7fe97bcd
- SHA1 60053d661ed03cd2a07f6750532e6ef11abcc4e5
- SHA512 d82eb0858819fc50b28910dfe8d537c8e7b0f34bc8953e48e7799b55ffe9320775df38c0ae38420808a0ddd84ea0d0c6b989b4348fcac52bbf2d1af7777091b8
- SSDEEP 3072:P6seqCp31Hgsp9a9GTrda8CAKLTsWkyc:CqCp31Z9a9GTrk8CV/t
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
1919319279
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850
- MD5 d6d956267a268c9dcf48445629d2803e
- SHA1 cc0feae505dad9c140dd21d1b40b518d8e61b3a4
- SHA512 e0791f6eb3116d0590be3af3713c94f787f7ced8e904d4bb8fc0d1341f332053414cb1e9095ae2de041b9e6d6d55cf773bf45ebeb74f27bb95c11a3cc364abee
- SSDEEP 1536:OXMLuZQG3KJ3QaIH9shR4fZcvr4C9u3MTIdD9mtthd9JovrgmqhtvM4CoLT6QPbc:gMLuZraJ3a0ehcvv9sM+9mtthd0gmWkr
- MD5 SHA1 SHA512 SSDEEP
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Thanos executable
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
95034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
85KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ