Analysis of .NET Thanos Ransomware Supporting Safeboot with Networking Mode

[tarekma7]

Last week, FortiGuard Labs captured a new Thanos ransomware sample. This ransomware is being popularly advertised on the underground market as a Ransomware-as-a-Service (RaaS) tool.

This new Thanos ransomware variant allows attackers to generate customized payloads with a wide variety of features and options. In addition, this malware sample uses an unknown obfuscator. It also has the powerful capability of bypassing 37 different antivirus, anti-VM, anti-debugging, and anti-sandboxing applications. And it also can reboot an infected Windows 7 system in safeboot-with-networking mode to bypass detection by antivirus software.

More info HERE