Home » Security Bloggers Network » Midas Ransomware : Tracing the Evolution of Thanos Ransomware Variants

Midas Ransomware : Tracing the Evolution of Thanos Ransomware Variants

by Rajdeepsinh Dodia on March 23, 2022

Key Takeaways: An in-depth analysis of Midas and trends across other Thanos ransomware variants reveals how ransomware groups shifted tactics in 2021 to:

lower sunk costs by using RaaS builders to reduce development time
increase payouts with double extortion tactics by using their own data leak sites
extend the length and effectiveness of campaigns to get the highest investment returns by updating payloads and/or rebranding their own ransomware group

Advertised on the darkweb for Ransomware-as-a-Service (RaaS), Thanos ransomware was first identified in February 2020. Written in C# language running on the .net framework, this serious offender reboots systems in safeboot mode to bypass antivirus detection and includes a builder that enables threat actors to create new variants by customizing samples. Source code of Thanos builder also leaked and there are lots of different variants that have been seen based on that. Here we discuss the four 2021 variants shown in Figure 1 below that used double extortion tactics.

Figure 1:Timeline of Thanos derived ransomware variations

Beginning in February 2021, the Prometheus ransomware variant emerged as one of the new Thanos built variants of the year. It encrypts files and appends “.[{ID}],.PROM[prometheushelp@mail{.}ch] , {ID}[prometheusdec@yahoo{.}com] “ extension and drop “RESTORE_FILES_INFO.txt, RESTORE_FILES_INFO.hta” ransom note. The Prometheus group which operates the variant has claimed to be part of the notorious REvil ransomware group responsible for the Kaseya supply chain attack, however experts doubt the claim as a solid connection between the two has never been established. This variant is known for using double extortion techniques to make organizations pay that include threatening to leak valuable data on their leak site. A quick check reveals that the leak site is currently down, but the threat still holds potential weight

Sponsorships Available

In July 2021, another Thanos derived ransomware called Haron was discovered. It encrypts files and appends “.{Targeted Company name}” extension and drops “RESTORE_FILES_INFO.hta,RESTORE_FILES_INFO.txt” ransom note. Haron ransomware group also have their own data leak site used for double extortion. This variant has striking similarities with Avaddon ransomware based on examination of the ransom note and data leak site information.

September 2021, the Thanos builder was used again to develop the Spook ransomware variant. It encrypts files and appends “.{ID}” extension and drops “RESTORE_FILES_INFO.hta,RESTORE_FILES_INFO.txt” ransom note. Similar to the other variants, Spook ransomware also uses double extortion techniques with their own data leak site as shown in the screenshot below.

Rounding out the year in October 2021, another Thanos ransomware family emerged with the Midas variant that appends “.{Targeted Company name}” extension and drops “RESTORE_FILES_INFO.hta and RESTORE_FILES_INFO.txt” ransom note. In January 2022, ThreatLabz investigated a report of Midas ransomware being slowly deployed over a 2-month period and the attacker was observed using different powershell scripts, remote access tools and an open source windows utility.

Like the others, Midas features its own data leak site for double extortion. Interestingly, the site contains leaked victim data from a Haron ransomware attack, suggesting to researchers that Midas is potentially linked to the Haron ransomware operators.

Figure 2: Count of companies with leaked data by 2021 Thanos ransomware variants.

Identifying Thanos as the Source for the Prometheus, Haron, Spook, and Midas ransomware variants

Tracing the evolution of Thanos based ransomware variants back to the source provides threat researchers with an inside look at how ransomware gangs operate and evolve over time. To establish a connection between each variant, the ThreatLabz team looked for the use of common signatures and indicators that would point back to the Thanos ransomware builder. After determining that each variant was derived using the builder, the team set about analyzing the similarities and differences in the shifting techniques adversaries employ to make new variants of a common origin ransomware more effective. These observations help us to gain insights into the cooperation happening between adversary groups and better understand the development lifecycle and alternating impacts of ransomware through its variants.

The analysis that follows walks you through identifying Thanos variants through an examination of common signatures found in the ransom note key identifiers and the consistent use of a common file marker “GotAllDone”. Followed by an in-depth analysis of the latest Midas variant.

Identifying Thanos Variants

All four of the 2021 Thanos based ransomware variants contain a key identifier with common signatures for the Thanos builder found in the ransom notes as shown in Figure 3 below.

Figure 3: Screenshots of ransom notes showing the common signature ‘Key Identifier’ for 2021 Thanos ransomware variants: Prometheus, Haron, Spook and Midas.

Another similarity is that after encryption they append base 64 encoded key after encrypting data of every file. Prometheus, Haron, Spook, and Midasall contain the same FileMarker that is “GotAllDone” appended at the end of each encrypted file. Below screenshot displays the FileMarker info and Base64 encoded key appended after the data encrypted by Midas ransomware.

Figure 4: Screenshots of FileMarker and Base64 encoded key appended

Midas Ransomware

The Midas data leak site currently displays data from 29 victim companies including data from several victims previously seen on the Haron data leak site which is now inactive.

Figure 5: Screenshot of the Midas ransomware data leak site index page.

Figure 6: Screenshot of victim companies listed on Midas ransomware data leak site.

Technical analysis

Midas ransomware is written in C# and obfuscated using smartassembly. Once executed this variant starts terminating processes using taskkill.exe. It terminates processes that inhibit encryption processes and processes related to security software, database related programs so it can encrypt more files. Below is a list of the common processes typically terminated by Thanos based ransomware.

Most commonly terminated processes:

RaccineSettings.exe

mspub.exe

CNTAoSMgr.exe

xfssvccon.exe

mydesktopqos.exe

sqlbrowser.exe

sqlwriter.exe

tbirdconfig.exe

visio.exe

sqlservr.exe

sqbcoreservice.exe

thebat64.exe

mysqld.exe

dbeng50.exe

Ntrtscan.exe

isqlplussvc.exe

synctime.exe

firefoxconfig.exe

winword.exe

ocomm.exe

agntsvc.exe

infopath.exe

ocautoupds.exe

mysqld-opt.exe

sqlagent.exe

powerpnt.exe

steam.exe

zoolz.exe

encsvc.exe

thebat.exe

tmlisten.exe

mbamtray.exe

PccNTMon.exe

mydesktopservice.exe

excel.exe

onenote.exe

msftesql.exe

wordpad.exe

ocssd.exe

mysqld-nt.exe

oracle.exe

dbsnmp.exe

outlook.exe

msaccess.exe

It also deletes the process, schedule task and registry related to the Raccine tool. It is a ransomware prevention tool that protects the system from ransomware processes to delete shadow copy.

Prometheus, Haron, Spook and Midas have been seen terminating Raccine related artifacts.

Figure 7: Command used to terminate Vaccine process and other artifacts.

The Midas variant is designed to stop service related to security products, database software, backups and email exchanges.

List of most commonly disrupted services:

start Dnscache /y
stop msexchangeimap4 /y

stop MSSQLServerADHelper /y

start FDResPub /y
stop ARSM /y

stop McAfeeEngineService /y

start SSDPSRV /y
stop MSSQL$BKUPEXEC /y

stop VeeamHvIntegrationSvc /y

start upnphost /y
stop unistoresvc_1af40a /y

stop MSSQLServerADHelper100 /y

stop avpsus /y
stop BackupExecAgentAccelerator /y

stop McAfeeFramework /y

stop McAfeeDLPAgentService /y
stop MSSQL$ECWDB2 /y

stop VeeamMountSvc /y

stop mfewc /y
stop audioendpointbuilder /y

stop MSSQLServerOLAPService /y

stop BMR Boot Service /y
stop BackupExecAgentBrowser /y

stop McAfeeFrameworkMcAfeeFramework /y

stop NetBackup BMR MTFTP Service /y
stop MSSQL$PRACTICEMGT /y
stop VeeamNFSSvc /y

stop DefWatch /y
stop BackupExecDeviceMediaService /y
stop MySQL57 /y

stop ccEvtMgr /y
stop MSSQL$PRACTTICEBGC /y
stop McShield /y

stop ccSetMgr /y
stop BackupExecJobEngine /y

stop VeeamRESTSvc /y

stop SavRoam /y
stop MSSQL$PROD /y
stop MySQL80 /y

stop RTVscan /y
stop AcronisAgent /y

stop McTaskManager /y

stop QBFCService /y
stop BackupExecManagementService /y

stop VeeamTransportSvc /y

stop QBIDPService /y
stop MSSQL$PROFXENGAGEMENT /y

stop OracleClientCache80 /y

stop Intuit.QuickBooks.FCS /y
stop Antivirus /y
stop mfefire /y

stop QBCFMonitorService /y
stop BackupExecRPCService /y
stop wbengine /y

stop YooBackup /y
stop MSSQL$SBSMONITORING /

stop ReportServer$SQL_2008 /y

stop YooIT /y
stop MSSQL$SBSMONITORING /y
stop mfemms /y

stop zhudongfangyu /y
stop AVP /y
stop wbengine /y

stop stc_raw_agent /y
stop BackupExecVSSProvider /y
stop RESvc /y

stop VSNAPVSS /y
stop MSSQL$SHAREPOINT /y
stop mfevtp /y

stop VeeamTransportSvc /y
stop DCAgent /y

stop sms_site_sql_backup /y

stop VeeamDeploymentService /y
stop bedbg /y

stop SQLAgent$BKUPEXEC /y

stop VeeamNFSSvc /y
stop MSSQL$SQL_2008 /y

stop MSSQL$SOPHOS /y

stop veeam /y
stop EhttpSrv /y

stop SQLAgent$CITRIX_METAFRAME /y

stop PDVFSService /y
stop MMS /y
stop sacsvr /y

stop BackupExecVSSProvider /y
stop MSSQL$SQLEXPRESS /y

stop SQLAgent$CXDB /y

stop BackupExecAgentAccelerator /y
stop ekrn /y

stop SAVAdminService /y

stop BackupExecAgentBrowser /y
stop mozyprobackup /y

stop SQLAgent$ECWDB2 /y

stop BackupExecDiveciMediaService /y
stop MSSQL$SYSTEM_BGC /y
stop SAVService /y

stop BackupExecJobEngine /y
stop EPSecurityService /y

stop SQLAgent$PRACTTICEBGC /y

stop BackupExecManagementService /y
stop MSSQL$VEEAMSQL2008R2 /y

stop SepMasterService /y

stop BackupExecRPCService /y
stop MSSQL$TPS /y

stop SQLAgent$PRACTTICEMGT /y

stop AcrSch2Svc /y
stop EPUpdateService /y
stop ShMonitor /y

stop AcronisAgent /y
stop ntrtscan /y

stop SQLAgent$PROD /y

stop CASAD2DWebSvc /y
stop MSSQL$TPSAMA /y
stop Smcinst /y

stop CAARCUpdateSvc /y
stop EsgShKernel /y

stop SQLAgent$PROFXENGAGEMENT /y

stop sophos /y
stop PDVFSService /y
stop SmcService /y

stop MsDtsServer /y
stop MSSQL$VEEAMSQL2008R2 /y

stop SQLAgent$SBSMONITORING /y

stop IISAdmin /y
stop ESHASRV /y
stop SntpService /y

stop MSExchangeES /y
stop SDRSVC /y

stop SQLAgent$SHAREPOINT /y

stop EraserSvc11710 /y
stop MSSQL$VEEAMSQL2012 /y
stop sophossps /y

stop MsDtsServer100 /y
stop FA_Scheduler /y

stop SQLAgent$SQL_2008 /y

stop NetMsmqActivator /y
stop SQLAgent$VEEAMSQL2008R2 /y

stop SQLAgent$SOPHOS /y

stop MSExchangeIS /y
stop MSSQLFDLauncher$PROFXENGAGEMENT /y

stop SQLAgent$SQLEXPRESS /y

stop SamSs /y
stop KAVFS /y
stop svcGenericHost /y

stop ReportServer /y
stop SQLWriter /y

stop SQLAgent$SYSTEM_BGC /y

stop MsDtsServer110 /y
stop MSSQLFDLauncher$SBSMONITORING /y
stop swi_filter /y

stop POP3Svc /y
stop KAVFSGT /y
stop SQLAgent$TPS /y

stop MSExchangeMGMT /y
stop VeeamBackupSvc /y
stop swi_service /y

stop SMTPSvc /y
stop MSSQLFDLauncher$SHAREPOINT /y

stop SQLAgent$TPSAMA /y

stop ReportServer$SQL_2008 /y
stop kavfsslp /y
stop swi_update /y

stop msftesql$PROD /y
stop VeeamBrokerSvc /y

stop SQLAgent$VEEAMSQL2008R2 /y

stop SstpSvc /y
stop MSSQLFDLauncher$SQL_2008 /y
stop swi_update_64 /y

stop MSExchangeMTA /y
stop klnagent /y

stop SQLAgent$VEEAMSQL2012 /y

stop ReportServer$SYSTEM_BGC /y
stop VeeamCatalogSvc /y
stop TmCCSF /y

stop MSOLAP$SQL_2008 /y
stop MSSQLFDLauncher$SYSTEM_BGC /y
stop SQLBrowser /y

stop UI0Detect /y
stop macmnsvc /y
stop tmlisten /y

stop MSExchangeSA /y
stop VeeamCloudSvc /y

stop SQLSafeOLRService /y

stop ReportServer$TPS /y
stop MSSQLFDLauncher$TPS /y
stop TrueKey /y

stop MSOLAP$SYSTEM_BGC /y
stop masvc /y

stop SQLSERVERAGENT /y

stop W3Svc /y
stop VeeamDeploymentService /y

stop TrueKeyScheduler /y

stop MSExchangeSRS /y
stop MSSQLFDLauncher$TPSAMA /y

stop SQLTELEMETRY /y

stop ReportServer$TPSAMA /y
stop MBAMService /y

stop TrueKeyServiceHelper /y

stop MSOLAP$TPS /y
stop VeeamDeploySvc /y

stop SQLTELEMETRY$ECWDB2 /y

stop msexchangeadtopology /y
stop MSSQLSERVER /y
stop WRSVC /y

stop AcrSch2Svc /y
stop MBEndpointAgent /y

stop mssql$vim_sqlexp /y

stop MSOLAP$TPSAMA /y
stop VeeamEnterpriseManagerSvc /y
stop vapiendpoint /y

Another technique used by most variants of Thanos based ransomware is to evade detection by finding and terminating processes for analysis tools by searching the list of keywords shown below:

http analyzer stand-alone
NetworkTrafficView
CFF Explorer

fiddler
HTTPNetworkSniffer
protection_id

effetech http sniffer
tcpdump
pe-sieve

firesheep
intercepter
MegaDumper

IEWatch Professional
Intercepter-NG
UnConfuserEx

dumpcap
ollydbg
Universal_Fixer

wireshark
dnspy-x86
NoFuserEx

wireshark portable
dotpeek
cheatengine

sysinternals tcpview
dotpeek64

NetworkMiner
RDG Packer Detector

Further, it changes the configuration of specific services as shown below.

Figure 8: Screenshot of service configuration changes.

It deletes shadow copy using powershell command so the system is unable to recover data.

Command : "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }

File Encryption

Midas ransomware searches through each drive and directory and encrypts the files. It creates a random key and encrypts a file using AES algorithm in CBC mode. Then the AES key is encrypted by the RSA public key as shown in the screenshot below. The encryption key is encoded in base64 and appended to each impacted file. It also added FileMarker “GotAllDone” at the end of each encrypted file. The encrypted key is also saved in the Registry under “HKEY_CURRENT_USER\SOFTWARE\KEYID\myKeyID”. After encryption, it drops the “reload1.lnk” file to open a ransom note at every restart.

Path: "C:\\Users\\{Username}\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\reload1.lnk".

Figure 9: Screenshot of encrypting AES key with RSA public key.

It encrypts the file contained below extensions:

After encryption it appends “.{Targeted Company name}” extension and drops “RESTORE_FILES_INFO.hta and RESTORE_FILES_INFO.txt” ransom note. Below is the screenshot of the ransom note. RESTORE_FILES_INFO.hta doesn’t contain Key ID but RESTORE_FILES_INFO.txt contains key ID.

Figure 10: Ransom note of Midas

Cloud Sandbox Detection

Figure 11: Zscaler Cloud Sandbox detection of Midas ransomware

In addition to sandbox detections, Zscaler’s multilayered cloud security platform detects indicators at various levels.

Win32.Ransom.Thanos

https://threatlibrary.zscaler.com/?threatname=win32.ransom.thanos

Win32.Ransom.Prometheus

https://threatlibrary.zscaler.com/?threatname=win32.ransom.prometheus

Win32.Ransom.Spook

https://threatlibrary.zscaler.com/?threatname=win32.ransom.spook

Win32.Ransom.Haron

https://threatlibrary.zscaler.com/?threatname=win32.ransom.haron