General

  • Target

    https://github.com/ytisf/theZoo/blob/master/malware/Binaries/Ransomware.Thanos/Ransomware.Thanos.zip

  • Sample

    241028-zg2qjsvma1

Malware Config

Targets

    • Target

      https://github.com/ytisf/theZoo/blob/master/malware/Binaries/Ransomware.Thanos/Ransomware.Thanos.zip

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Thanos Ransomware

      Ransomware-as-a-service (RaaS) sold through underground forums.

    • Thanos executable

    • Thanos family

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks