General
-
Target
16636615442.zip
-
Size
406KB
-
Sample
240417-mmtkxadg4z
-
MD5
5626da20f2428da77f4468329b141fff
-
SHA1
ad516b2a38f4324fb2f918d59de100b788054525
-
SHA256
5b378ee2fe33c095c6d4a002ccb25548c35da9ea1045e9db82002e31f84781f1
-
SHA512
40366632643bb084e6312c5a83d31983e9cf337a428c3c02a4cccbb02df1157b37d36304ada533706179894c9b25ed9c9bbebeba3b536b12a592cf27d01f5773
-
SSDEEP
12288:62C6EwF2I0yClBTxvlTekgEkKdpqJtUMnilYsl:62CdG2FywbtLged4JW3l
Static task
static1
Behavioral task
behavioral1
Sample
101bd45ab673fd6547386dff4339f1649e61b9f5c318260d365f766fbdc2d3c9.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
101bd45ab673fd6547386dff4339f1649e61b9f5c318260d365f766fbdc2d3c9.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
C:\PerfLogs\akira_readme.txt
akira
https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion
Targets
-
-
Target
101bd45ab673fd6547386dff4339f1649e61b9f5c318260d365f766fbdc2d3c9
-
Size
1005KB
-
MD5
427eba9f6ff2cd312c72770f13e279c1
-
SHA1
221e45064829d5ca7852aa5421d5284986916d93
-
SHA256
101bd45ab673fd6547386dff4339f1649e61b9f5c318260d365f766fbdc2d3c9
-
SHA512
2101d82c1e4536536410de403bbe5b438a3688690fd3108f3c4ffc7fca90be4888b7ba088f648c68089e28e9729385ac2299d2d087f04590ff7fe6d97beb557b
-
SSDEEP
12288:wbWIqB/A1gv9XQ7ZNlZDV3LEWI+Xx+uBW6y4qNmhA9:wbyxv9XQ7B3oWI+XHW6y449
Score10/10-
Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Renames multiple (8442) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-