General
-
Target
2e2ad6392e75d5a5155498c2a76cb373d17ca3ad4ba57c6d33c623fca5e29342.exe
-
Size
573KB
-
Sample
241106-ctsbbavrhr
-
MD5
bff3fdbff0a5d4aa1c03f7982c968e54
-
SHA1
651c70f9d995c52fa48493b2e60904d15cad8821
-
SHA256
2e2ad6392e75d5a5155498c2a76cb373d17ca3ad4ba57c6d33c623fca5e29342
-
SHA512
541fdc664699f5cfa044b3755e0ff7cc931be7b059975ce1e9ca54799e8c320570845782ef2c610a3d82dd7169f7576e3baa45240966e5e23d05fe59de1605d3
-
SSDEEP
6144:8KIpz8gbJnHlZB1wYvPgwi/YkVlWGGv5wVRU/rCPED3xTfuRkbjaRVepohAYHdG6:BGz7JHsYKN2v5/G+TfuR1VioyYHjS
Static task
static1
Behavioral task
behavioral1
Sample
2e2ad6392e75d5a5155498c2a76cb373d17ca3ad4ba57c6d33c623fca5e29342.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2e2ad6392e75d5a5155498c2a76cb373d17ca3ad4ba57c6d33c623fca5e29342.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\MSOCache\All Users\akira_readme.txt
akira
https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion
Targets
-
-
Target
2e2ad6392e75d5a5155498c2a76cb373d17ca3ad4ba57c6d33c623fca5e29342.exe
-
Size
573KB
-
MD5
bff3fdbff0a5d4aa1c03f7982c968e54
-
SHA1
651c70f9d995c52fa48493b2e60904d15cad8821
-
SHA256
2e2ad6392e75d5a5155498c2a76cb373d17ca3ad4ba57c6d33c623fca5e29342
-
SHA512
541fdc664699f5cfa044b3755e0ff7cc931be7b059975ce1e9ca54799e8c320570845782ef2c610a3d82dd7169f7576e3baa45240966e5e23d05fe59de1605d3
-
SSDEEP
6144:8KIpz8gbJnHlZB1wYvPgwi/YkVlWGGv5wVRU/rCPED3xTfuRkbjaRVepohAYHdG6:BGz7JHsYKN2v5/G+TfuR1VioyYHjS
Score10/10-
Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
-
Akira family
-
Renames multiple (8582) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file
-
Drops desktop.ini file(s)
-