Malware
Hakbit
aka Thanos Ransomware
Hakbit ransomware is written in .NET. It uploads (some) files to be encrypted to a ftp-server.
Hakbit, also known as Thanos Ransomware, is a Windows malware family.
Background
Hakbit is a .NET ransomware that uploads some of the files it intends to encrypt to an ftp-server. Its ransom note is stored within the binary, appearing as a plain string in older builds and later as a base64 string; some variants apply light obfuscation to these strings.
Victims are told to make contact through a protonmail-hosted email address. The original Hakbit used hakbit@, whereas the newer "KiraLock" variant uses kiraransom@, among others.
Source: Malpedia (Fraunhofer FKIE).