Thanatos-Ransomware

Introduction

Ransomware developers continue to release infections that are clearly not tested well and contain bugs that may make it difficult, if not impossible, for victims to recover their files. Such is the case with the new in the wild ransomware called Thanatos.

![NEWS]

Source Ransomware

Resource Ransomware ![Discordapp]

Pay Attention Malicious File : ![VirusTotal]

Samples for researchers :

Best place ![VirusBay]

Network Traffic

GET /1CUTM6 HTTP/1.1..Connection: Keep-Alive..Content-Type: application/x-www-form-urlencoded..U ser-Agent: Mozilla/5.0 (Windows NT 6.1) Thanatos/1.1..Host: iplogger.com....

hxxp://iplogger[.]com:80/1CUTM6 hxxp://iplogger[.]com:80/1t3i37

IP : 88.99.66.31 Port : 80

Description :

This url allow attacker to know information victims and stay update to know any new location.

Behaviour

PDB path : C:\Users\Artur\Desktop\csharp - js\косте пизда\Release\Thanatos.pdb

Let's take a look at source code :

Yara Rules

` rule Thanatos

{ strings:

    $s1 = ".THANATOS\x00" ascii
    $s2 = "\\Desktop\\README.txt" ascii
    $s3 = "C:\\Windows\\System32\\notepad.exe C:\\Users\\" ascii
    $s4 = "AppData\\Roaming" ascii
    $s5 = "\\Desktop\x00" ascii
    $s6 = "\\Favourites\x00" ascii
    $s7 = "\\OneDrive\x00" ascii
    $s8 = "\\x00.exe\x00" ascii
    $s9 = "/c taskkill /im" ascii
    $s10 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii

    condition:
    6 of ($s1, $s2, $s3, $s4, $s5, $s6, $s7, $s8, $s9, $s10)

} `

Decrypt Files :

![Download Released ThanatosDecryptor]

Know Structure Thanatos Ransomware and check Source Code

You can check source code from ![Here]