General
-
Target
39e8cc7d47b69341908afda35046dbcccf118271918e69c4012dd35923b55c9f.exe
-
Size
1.0MB
-
Sample
250116-nkz6caxrdz
-
MD5
95f6de7442e040fb10547140a05ddd45
-
SHA1
27274d7377a45afa593c649c05e01061240a15da
-
SHA256
39e8cc7d47b69341908afda35046dbcccf118271918e69c4012dd35923b55c9f
-
SHA512
828e53bd5b5fa70483f78bc6e77dd992dd5ef47ee65a9b72ad24f666f859ca62e3e63ba581eb864cd31ca24b53034539b465391cf65dec1e10813e4a7d53a857
-
SSDEEP
12288:Vpp+QIEmDzuImC01vbUE98pik+2i1NkshdMMK+AX99etq2dTdof:Vpp+Q+u5bUI8pij1NkshdMf99etb5K
Static task
static1
Behavioral task
behavioral1
Sample
39e8cc7d47b69341908afda35046dbcccf118271918e69c4012dd35923b55c9f.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
39e8cc7d47b69341908afda35046dbcccf118271918e69c4012dd35923b55c9f.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\MSOCache\All Users\akira_readme.txt
akira
https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/7410158986-JFTRI
Targets
-
-
Target
39e8cc7d47b69341908afda35046dbcccf118271918e69c4012dd35923b55c9f.exe
-
Size
1.0MB
-
MD5
95f6de7442e040fb10547140a05ddd45
-
SHA1
27274d7377a45afa593c649c05e01061240a15da
-
SHA256
39e8cc7d47b69341908afda35046dbcccf118271918e69c4012dd35923b55c9f
-
SHA512
828e53bd5b5fa70483f78bc6e77dd992dd5ef47ee65a9b72ad24f666f859ca62e3e63ba581eb864cd31ca24b53034539b465391cf65dec1e10813e4a7d53a857
-
SSDEEP
12288:Vpp+QIEmDzuImC01vbUE98pik+2i1NkshdMMK+AX99etq2dTdof:Vpp+Q+u5bUI8pij1NkshdMf99etb5K
-
Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
-
Akira family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Renames multiple (8618) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell
Run Powershell command to delete shadowcopy.
-
Drops startup file
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-