General
-
Target
5ea65e2bb9d245913ad69ce90e3bd9647eb16d992301145372565486c77568a2.bin.sample
-
Size
1005KB
-
Sample
240904-mfjr5azbqa
-
MD5
9ce8e06f1de868e553758b242b82a1c4
-
SHA1
fa4f010ffa3a8e970cc4f47e86ff13dbb50c9fec
-
SHA256
5ea65e2bb9d245913ad69ce90e3bd9647eb16d992301145372565486c77568a2
-
SHA512
072a1d98b455df8cd89e798cfc4aa3c82b9b5e1abbed27b2bbb23d84b631df5d8276d4e3d6cfecbfadd612a89f2d06c6b4abbc924b85556c9530f6c63f273a2c
-
SSDEEP
12288:wbWIqB/A1gv9XQ7ZNlZDV3LEWI+Xx+uBW6y4qNmh+:wbyxv9XQ7B3oWI+XHW6y4G
Static task
static1
Behavioral task
behavioral1
Sample
5ea65e2bb9d245913ad69ce90e3bd9647eb16d992301145372565486c77568a2.bin.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5ea65e2bb9d245913ad69ce90e3bd9647eb16d992301145372565486c77568a2.bin.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
C:\MSOCache\All Users\akira_readme.txt
akira
https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion
Targets
-
-
Target
5ea65e2bb9d245913ad69ce90e3bd9647eb16d992301145372565486c77568a2.bin.sample
-
Size
1005KB
-
MD5
9ce8e06f1de868e553758b242b82a1c4
-
SHA1
fa4f010ffa3a8e970cc4f47e86ff13dbb50c9fec
-
SHA256
5ea65e2bb9d245913ad69ce90e3bd9647eb16d992301145372565486c77568a2
-
SHA512
072a1d98b455df8cd89e798cfc4aa3c82b9b5e1abbed27b2bbb23d84b631df5d8276d4e3d6cfecbfadd612a89f2d06c6b4abbc924b85556c9530f6c63f273a2c
-
SSDEEP
12288:wbWIqB/A1gv9XQ7ZNlZDV3LEWI+Xx+uBW6y4qNmh+:wbyxv9XQ7B3oWI+XHW6y4G
-
Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Renames multiple (8638) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell
Run Powershell command to delete shadowcopy.
-
Drops startup file
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-