This malware is unique because of two aspects:
- It's usage of Bitcoin cash. This is a split from the main Bitcoin that tries to make peer to peer exchange.
- It creates encrypted files, without saving the keys which are essential for decrypting them back. This means that even if you pay the ransom, it’s unlikely that the developers of the malware will ever be able to decrypt your data.
The good news is that SentinelOne protects against Thanatos. By using machine learning techniques and based on the malware behavior, SentinelOne technology detects the malware as harmful and prevents it from executing.
In this video, you can see how SentinelOne blocks the Thanatos Ransomware even when offline. The logic that is capable of detecting and blocking the threat resides on the agent side, making the time from detection to mitigation be friction of a second.
