General
-
Target
473326da3fff09ee3e486f5f39c090690437ac8bf8bdce556c8033e8f0d730fc.bin.sample
-
Size
576KB
-
Sample
240618-mplyvatfnp
-
MD5
e6f72dd4d9da34dff7a1a47b8506f762
-
SHA1
31af7f96a9df14900089a528dd9a3b9ce3549ace
-
SHA256
473326da3fff09ee3e486f5f39c090690437ac8bf8bdce556c8033e8f0d730fc
-
SHA512
abbed067cd7ef355ee24307fb078a3327f7b7d1d628f7e5d2d823fe89c36efd1fa0de4bed1beaa3f6777aa93856de17a324c85892262e659368703c47651b4fc
-
SSDEEP
12288:KR4bbb4DT8Rx92j5PeMJcyWEOrYlohFVPnp:KR4X0fcx94teMJcyWERlYp
Static task
static1
Behavioral task
behavioral1
Sample
473326da3fff09ee3e486f5f39c090690437ac8bf8bdce556c8033e8f0d730fc.bin.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
473326da3fff09ee3e486f5f39c090690437ac8bf8bdce556c8033e8f0d730fc.bin.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
C:\MSOCache\All Users\akira_readme.txt
akira
https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion
Targets
-
-
Target
473326da3fff09ee3e486f5f39c090690437ac8bf8bdce556c8033e8f0d730fc.bin.sample
-
Size
576KB
-
MD5
e6f72dd4d9da34dff7a1a47b8506f762
-
SHA1
31af7f96a9df14900089a528dd9a3b9ce3549ace
-
SHA256
473326da3fff09ee3e486f5f39c090690437ac8bf8bdce556c8033e8f0d730fc
-
SHA512
abbed067cd7ef355ee24307fb078a3327f7b7d1d628f7e5d2d823fe89c36efd1fa0de4bed1beaa3f6777aa93856de17a324c85892262e659368703c47651b4fc
-
SSDEEP
12288:KR4bbb4DT8Rx92j5PeMJcyWEOrYlohFVPnp:KR4X0fcx94teMJcyWERlYp
-
Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Renames multiple (8597) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell
Run Powershell command to delete shadowcopy.
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-