Extracted

• • Target

    win32_locker.ex_.exe

  • Size

    879KB

  • MD5

    2a7a76cde7e970c06316e3ae4feadbe3

  • SHA1

    89d195f59bba9c3b43635607f9f1c3051645332c

  • SHA256

    2c7aeac07ce7f03b74952e0e243bd52f2bfa60fadc92dd71a6a1fee2d14cdd77

  • SHA512

    834f76c0de678d26507fa1a3446cf6336952d36bd2857113f1bbaddf0d33132d4c579bfd232194868c8dc4ddefa66a9c589610e74f4a808787b8edf36f3d5b4f

  • SSDEEP

    24576:dpN2CMwVhLcqnB+c9z2Va31qIU2p1GA3zaIJYj9+M+C6vU1KKoPAFGG+TR3aZX:UC5Uqn4c9z2Vu1qIU2pAA3rM+C6vZJAp

  Score

  10^/10

  akiracredential_accessdiscoveryexecutionransomwareransowmwarespywarestealerpersistence

  • Akira

    Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.

    ransomwareakira

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Renames multiple (9035) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell command to delete shadowcopy.

    executionransowmware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  behavioral1behavioral2