A Study of Thanos Ransomware Variants

This ThreatLabz report analyzes Thanos builder–derived ransomware families observed in 2021 (Prometheus, Haron, Spook, Midas), describing their shift to RaaS models and double-extortion via dedicated leak sites. The technical analysis of Midas covers infection behaviors (process and service termination, shadow copy deletion), encryption (Salsa20 per-file keys wrapped with RSA, base64 key appended and FileMarker "GotAllDone"), common ransom notes/extensions, disrupted services/process lists, sandbox detections, and provided IOCs including an MD5 hash.