thanos | cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787

Sharing

Copy URL Twitter E-mail

General

Target
Ransomware.Thanos.zip
Size 145KB
Sample251023-bdws5aeq5y
SHA256 cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787
MD5 00184463f3b071369d60353c692be6f0
SHA1 d3c1e90f39da2997ef4888b54d706b1a1fde642a
SHA512 baa931a23ecbcb15dda6a1dc46d65fd74b46ccea8891c48f0822a8a10092b7d4f7ea1dc971946a161ac861f0aa8b99362d5bea960b47b10f8c91e33d1b018006
SSDEEP 3072:fn8L7y+NJQpRhkU0kbH2PNo/1GjTqOncYIOSsk:f8L7xNJQFzCo/ojTqOnYD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f
- Size 82KB
- SHA256 58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f
- MD5 e01e11dca5e8b08fc8231b1cb6e2048c
- SHA1 4983d07f004436caa3f10b38adacbba6a4ede01a
- SHA512 298bfb9fe55ddd80f1c6671622d7e9e865899a855b5bb8e0d85d8520160cedca6fd8bc72c9881925477bcab883bf6e6f4c69f997b774b74fe992e023a81269de
- SSDEEP 1536:PcW4lAJGGnzjoih/NDh/NDuk+XkGAK/hztXcag+PlbBfkWIyvZrw281r5XsmCZEe:UWNGszjoih/NDh/NDuk+XkGAK/hztXcQ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

defense_evasion discovery evasion execution impact persistence ransomware trojan spyware
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Drops startup file
- Windows security modification
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Modifies WinLogon
  persistence
behavioral1 behavioral2
- Target
  5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d
- Size 91KB
- SHA256 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d
- MD5 be60e389a0108b2871dff12dfbb542ac
- SHA1 14b4e0bfac64ec0f837f84ab1780ca7ced8d670d
- SHA512 6051bec441434a80c34ee2752a3da9c3a0307cd1b551aa27a0f7f6f75b9bf64b172745d80f03eea054a03ebd2c493df21fd48d8fa3b706d46a6f7fee0e7c0641
- SSDEEP 1536:QguHLgeS6umiCp31W4qYXgsLlOqrgB9GpF7LXdarTkCAKL5dsluhtvM4CoLT6QPg:D6seqCp31Hgsp9a9GTrda8CAKLTsWkyI
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

defense_evasion discovery execution ransomware
- Renames multiple (60) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Drops startup file
- Executes dropped EXE
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Legitimate hosting services abused for malware hosting/C2
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral3 behavioral4
- Target
  ae66e009e16f0fad3b70ad20801f48f2edb904fa5341a89e126a26fd3fc80f75
- Size 100KB
- SHA256 ae66e009e16f0fad3b70ad20801f48f2edb904fa5341a89e126a26fd3fc80f75
- MD5 03b76a5130d0df8134a6bdea7fe97bcd
- SHA1 60053d661ed03cd2a07f6750532e6ef11abcc4e5
- SHA512 d82eb0858819fc50b28910dfe8d537c8e7b0f34bc8953e48e7799b55ffe9320775df38c0ae38420808a0ddd84ea0d0c6b989b4348fcac52bbf2d1af7777091b8
- SSDEEP 3072:P6seqCp31Hgsp9a9GTrda8CAKLTsWkyc:CqCp31Z9a9GTrk8CV/t
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850
- Size 87KB
- SHA256 c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850
- MD5 d6d956267a268c9dcf48445629d2803e
- SHA1 cc0feae505dad9c140dd21d1b40b518d8e61b3a4
- SHA512 e0791f6eb3116d0590be3af3713c94f787f7ced8e904d4bb8fc0d1341f332053414cb1e9095ae2de041b9e6d6d55cf773bf45ebeb74f27bb95c11a3cc364abee
- SSDEEP 1536:OXMLuZQG3KJ3QaIH9shR4fZcvr4C9u3MTIdD9mtthd9JovrgmqhtvM4CoLT6QPbc:gMLuZraJ3a0ehcvv9sM+9mtthd0gmWkr
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

defense_evasion discovery evasion execution impact persistence ransomware trojan spyware
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (56) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Drops startup file
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Modifies WinLogon
  persistence
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral7 behavioral8