General
-
Target
a5806174261004a0b8b5c0be808a77e5f25b867a4c522813035c2b0dc05d90a2.zip
-
Size
412KB
-
Sample
250110-n5by9awlaq
-
MD5
eb75ad32764bf1114c80c4837594af10
-
SHA1
110ad1b626c47aab7e7a6ff50bb78cf68fb9b705
-
SHA256
a5c81704f5db48c7412e9f5ca07bfa980285effa2dd0b6a93341bb9683f736d5
-
SHA512
bb4c91493d68dd7d21476b86f9facc9ca99971c781f458429ed88cc128abdaa6bd488fab28a7c7dd08475141f615a40d3b4ddd6ccde6cf04032e9dcc63627668
-
SSDEEP
6144:F3oqBqQKA3Q79FmFngGbQN/cXHKnLkgzqwIbjE/LqClXLvZESsqyE2ZsJoBzEC:FNW+FgGbQN/cX8dInEZv9sqySJoBP
Static task
static1
Behavioral task
behavioral1
Sample
a5806174261004a0b8b5c0be808a77e5f25b867a4c522813035c2b0dc05d90a2.exe
Resource
win10ltsc2021-20241211-en
Malware Config
Extracted
C:\Program Files\7-Zip\akira_readme.txt
akira
https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/2779333196-TRVUX
Targets
-
-
Target
a5806174261004a0b8b5c0be808a77e5f25b867a4c522813035c2b0dc05d90a2.exe
-
Size
1.0MB
-
MD5
86453f01deb226e67a4f0f24449ca301
-
SHA1
e3c92886733ae58f174f74553abce68826abad5a
-
SHA256
a5806174261004a0b8b5c0be808a77e5f25b867a4c522813035c2b0dc05d90a2
-
SHA512
b265f7dbb46a8bd05a141688384b03207c1ea9e9f15fdd79e1a8d305640fd809e897e689e9e6ad2bbd126b126424b3c1873c4c6c60f65954daf8c19606644302
-
SSDEEP
12288:Vpp+QIEmDzuImC01vbUE98pik+2i1NkshdMMK+AX99etq2dTdTf:Vpp+Q+u5bUI8pij1NkshdMf99etb5B
-
Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
-
Akira family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Renames multiple (8236) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell
Run Powershell command to delete shadowcopy.
-
Drops startup file
-
Drops desktop.ini file(s)
-