Loading malware…
Thanatos is a Windows ransomware family discovered in the wild in February 2018. Multiple versions were observed, including versions 1 and 1.1, with evolving ransom notes and cryptocurrency payment options. Its distribution included attachments sent through Discord chat messages. Observed deployment was limited, and no specific threat actor or industry targeting has been established.
When executed, Thanatos copies itself into a randomly named application-data subdirectory and recursively searches common user-profile folders for files to encrypt. It targets files with an extension rather than using a narrow extension allowlist. Each file is encrypted with AES-256 using a key derived from system uptime through GetTickCount. The malware discards the keys, writes renamed encrypted copies, and deletes the original files. This flawed design prevents its operators from reliably restoring victim data even after payment. At least one observed variant explicitly stated that decryption was unavailable and omitted payment instructions.
Thanatos displays a ransom note and configures a Windows autorun entry to reopen that note at login, rather than establishing persistence for the ransomware executable. It also makes HTTP requests to an infection-tracking service. Version 1.1 accepted Bitcoin, Ethereum, and Bitcoin Cash and used email-based payment coordination.
Cisco Talos released ThanatosDecryptor, a free recovery utility tested against versions 1 and 1.1. It exploits the constrained uptime-derived key space, using Windows event records, encrypted-file timestamps, and known file headers to recover supported file types. The ransomware should not be conflated with the earlier Thanatos Trojan, internally called Alphabot, observed in 2016.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
The malware appears to have been delivered to the victim as an attachment to a chat message sent to the victim using the Discord chat platform.
The malware appears to have been delivered to the victim as an attachment to a chat message sent to the victim using the Discord chat platform.
Finally, it will generate an autorun key called "Microsoft Update System Web-Helper" that opens the README.txt ransom note every time a user logs in.
Finally, it will generate an autorun key called "Microsoft Update System Web-Helper" that opens the README.txt ransom note every time a user logs in.
The filename used in this case was "fastleafdecay.exe" which may indicate that the victim was tricked into executing the malware as it was posing as a mod of the same name in the video game Minecraft.
The malware also leverages an external website called iplogger... By making HTTP GET requests using these hardcoded URLs, the attacker can obtain information about all of the different systems that have been infected with Thanatos.
Thanatos recursively scans the following directories within the current user's profile to identify files to encrypt: Desktop Documents Downloads Favourites Music OneDrive Pictures Videos
After the encryption process is finished it will then connect to iplogger.com/1t3i37 URL in order to keep track of the amount of victims that have been infected.
The malware appears to have been delivered to the victim as an attachment to a chat message sent to the victim using the Discord chat platform. The URL hosting the attached malware is below: hxxps://cdn[.]discordapp[.]com/.../fastleafdecay.exe | When executed on victim systems, Thanatos copies itself into a subdirectory that it creates within %APPDATA%/Roaming.
Back in February we wrote about a new ransomware called Thanatos that was encrypting victim's data... Victim's of this ransomware would also have their files encrypted and the names of the file's would have the .THANATOS extension appended to them.
20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.