Rewterz Threat Alert – Thanos Ransomware – Active IOCs

Severity

Medium

Analysis Summary

The Thanos ransomware was first discussed by Recorded Future in February 2020 when it was advertised for sale on underground forums. The Thanos ransomware has a builder that allows actors to customize the sample with a variety of available settings. The fact Thanos is for sale suggests the likelihood of multiple threat actors using this ransomware. However, we believe with high confidence that the same actor used a Thanos variant in attacks on two state-run organizations in the Middle East and North Africa. The Thanos variant created a text file that displayed a ransom message requesting the victim to transfer “20,000$” into a specified Bitcoin wallet to restore the files on the system. Below is the ransom note found on encrypted machines.

Impact

• Files Encryption

Indicators of Compromise

MD5

• 54e8989f3595120a430b8d31ca87c0cc
• 6ee908f96417fb283e6f20f133a0e478

SHA-256

• 74a717027b6212236662bf641c473b8f8cd65486898b02940357bb9b3035f38a
• ce686daaf9d97fb2c42d9789d19f1dbdb81d1b45851cf3d9e67f46b578365764

SHA-1

• 30609e95e4396e7c409b21e0d96c185736cc01d2
• 220d48d43f57951ec8cdb0e0cd348e7d1848eef7

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.