General
-
Target
88da2b1cee373d5f11949c1ade22af0badf16591a871978a9e02f70480e547b2.bin.sample
-
Size
1.0MB
-
Sample
241112-t3srwazmal
-
MD5
b163803130f466db74f68a19f9cee11e
-
SHA1
c0aafc8c63d0bf316722968d1fe8f1d7637271cd
-
SHA256
88da2b1cee373d5f11949c1ade22af0badf16591a871978a9e02f70480e547b2
-
SHA512
19991bc15375fd8105b2e27cf927fd69942676c4b29daa29d3127563b5c7a9bc4280ef9e04ad7b5564583c3df3557013848a036c75796e845d3c7aa3e25474ac
-
SSDEEP
12288:Vpp+QIEmDzuImC01vbUE98pik+2i1NkshdMMK+AX99etq2dTdeOf:Vpp+Q+u5bUI8pij1NkshdMf99etb5sO
Static task
static1
Behavioral task
behavioral1
Sample
88da2b1cee373d5f11949c1ade22af0badf16591a871978a9e02f70480e547b2.bin.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
88da2b1cee373d5f11949c1ade22af0badf16591a871978a9e02f70480e547b2.bin.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\MSOCache\All Users\akira_readme.txt
akira
https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion
Targets
-
-
Target
88da2b1cee373d5f11949c1ade22af0badf16591a871978a9e02f70480e547b2.bin.sample
-
Size
1.0MB
-
MD5
b163803130f466db74f68a19f9cee11e
-
SHA1
c0aafc8c63d0bf316722968d1fe8f1d7637271cd
-
SHA256
88da2b1cee373d5f11949c1ade22af0badf16591a871978a9e02f70480e547b2
-
SHA512
19991bc15375fd8105b2e27cf927fd69942676c4b29daa29d3127563b5c7a9bc4280ef9e04ad7b5564583c3df3557013848a036c75796e845d3c7aa3e25474ac
-
SSDEEP
12288:Vpp+QIEmDzuImC01vbUE98pik+2i1NkshdMMK+AX99etq2dTdeOf:Vpp+Q+u5bUI8pij1NkshdMf99etb5sO
-
Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
-
Akira family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Renames multiple (8567) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell
Run Powershell command to delete shadowcopy.
-
Drops startup file
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-