General
-
Target
b3f473b0fd752fcd8b0d5983366c4ccccdacdceb8d6ba25fcb02b34c622cca78.bin.sample
-
Size
578KB
-
Sample
240716-xjaczavfql
-
MD5
a74812faa9245f21516393218545387c
-
SHA1
6bd48f5f1d861ad57b9dffd8e4aa7fe3b3c6a110
-
SHA256
b3f473b0fd752fcd8b0d5983366c4ccccdacdceb8d6ba25fcb02b34c622cca78
-
SHA512
97d09e6a2f0b81a27d68ee862752097e9095de1aec224cfb8644a71e107067c39f7556fd62ca50ab420632975ee36650224dbc93d4c6c1cf072a342ee26fa6e8
-
SSDEEP
12288:uR4AbrJu2EFu3A/140My7o5vxoFrURYL:uR4oFuHF2A/140MyQx+wR
Static task
static1
Behavioral task
behavioral1
Sample
b3f473b0fd752fcd8b0d5983366c4ccccdacdceb8d6ba25fcb02b34c622cca78.bin.exe
Resource
win10-20240404-en
Malware Config
Extracted
F:\akira_readme.txt
akira
https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion
Targets
-
-
Target
b3f473b0fd752fcd8b0d5983366c4ccccdacdceb8d6ba25fcb02b34c622cca78.bin.sample
-
Size
578KB
-
MD5
a74812faa9245f21516393218545387c
-
SHA1
6bd48f5f1d861ad57b9dffd8e4aa7fe3b3c6a110
-
SHA256
b3f473b0fd752fcd8b0d5983366c4ccccdacdceb8d6ba25fcb02b34c622cca78
-
SHA512
97d09e6a2f0b81a27d68ee862752097e9095de1aec224cfb8644a71e107067c39f7556fd62ca50ab420632975ee36650224dbc93d4c6c1cf072a342ee26fa6e8
-
SSDEEP
12288:uR4AbrJu2EFu3A/140My7o5vxoFrURYL:uR4oFuHF2A/140MyQx+wR
-
Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Renames multiple (7726) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell
Run Powershell command to delete shadowcopy.
-
Drops startup file
-
Drops desktop.ini file(s)
-