Thanos Operator Targets Police Department in United Arab Emirates

Overview

The SonicWall Capture Labs threat research team has come across a variant of Thanos ransomware targeted at a police department in the United Arab Emirates (UAE).  Thanos ransomware is a customizable and highly adaptable ransomware-as-a-service (RaaS) tool that allows cybercriminals to create and deploy ransomware tailored to their needs. It is known for its data-stealing capabilities, the ability to spread through networks and the use of advanced evasion techniques to avoid detection.

Infection Cycle

Upon infection, the following notification appears on the desktop.

Figure 1: Notification

Files on the system are encrypted.  Each encrypted file has the text “.crypted” appended to its name A ransom note asking for $20,000 in Bitcoin is displayed on the desktop:

Figure 2: Ransom message

A file named HOW_TO_DECYPHER_FILES.txt is dropped into all directories containing encrypted files.  It contains the following message:

Figure 3: Ransom message text file

If the system is rebooted, the following message is displayed during the login process:

Figure 4: Ransom message after reboot

The malware is written in .NET and is obfuscated.  However, after disassembly, this obfuscation is easily thwarted as it only uses base64 to encode all of its strings.  Using the following simple script, we were able to decode all base64 encoded strings and reveal the malware’s functionality:

Figure 5: Simple deobfuscation script

Figure 6: Deobfuscated code

The Thanos signature can be seen in the deobfuscated code:

Figure 7: Thanos marker

The “.crypted” file extension and a list of filetypes targeted for encryption is visible:

Figure 8: Targeted file types

The Windows Task Manager and various other backup and recovery services are disabled:

Figure 9: Disabling task manager

Figure 10: Disabling system recovery

The following base64 encoded text decodes to https://www.poweradmin.com/paexec/paexec.exe.  Power Admin is downloaded and executed on the system for remote administration:

Figure 11: Power Admin download

ProcessHide is also downloaded and is used to hide Power Admin from process monitoring applications such as Windows Task Manager:

Figure 12: ProcessHide download

The malware scans the internal network for online machines.  The username and password that was used leads us to believe that this variant of the malware is targeted toward the Sharjah Police Force in the UAE:

Figure 13: Network scanning

If those credentials do not work, there is a bigger list of usernames and passwords to try:

Figure 14: Additional credentials to try

We tried to reach out to the operator via email, but the email bounced. SonicWall Capture Labs provides protection against this threat via the following signature:

• GAV: Thanos.RSM_2(Trojan)

This threat is also detected by SonicWall Capture ATP w/RTDMI and the Capture Client endpoint solutions.