General
-
Target
akira.exe
-
Size
1.0MB
-
Sample
250211-y9ldlazjhs
-
MD5
1a4a4eb6dfc583c02c70bf83fc0e3cd1
-
SHA1
627f5b93531373e44889553f39e62323edd7db6f
-
SHA256
db9060c4be0fb23d59a7059512c08dd11182e0c47c0d429b2d91af763ca4d28a
-
SHA512
d13d4645b2259028ce6ad723f9fea54c25cf4b4453f279333e9335b3900da55b5c84e7a3b9356f9f0f789afaf9a3add459d8dcff87adec5d7d77ce03e26da7c0
-
SSDEEP
12288:RU/gkiCJVmaeyY1/29UDdxcKw9RKlRm5NulkMekVqjx8FqbzXuv+vS+hX4Ffq7YE:RU/NjjmT2SDdXk8FqbzX9S+2FfdFy
Static task
static1
Behavioral task
behavioral1
Sample
akira.exe
Resource
win10v2004-20250207-en
Malware Config
Extracted
C:\Program Files (x86)\akira_readme.txt
akira
https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/3361927117-BWSQJ
Targets
-
-
Target
akira.exe
-
Size
1.0MB
-
MD5
1a4a4eb6dfc583c02c70bf83fc0e3cd1
-
SHA1
627f5b93531373e44889553f39e62323edd7db6f
-
SHA256
db9060c4be0fb23d59a7059512c08dd11182e0c47c0d429b2d91af763ca4d28a
-
SHA512
d13d4645b2259028ce6ad723f9fea54c25cf4b4453f279333e9335b3900da55b5c84e7a3b9356f9f0f789afaf9a3add459d8dcff87adec5d7d77ce03e26da7c0
-
SSDEEP
12288:RU/gkiCJVmaeyY1/29UDdxcKw9RKlRm5NulkMekVqjx8FqbzXuv+vS+hX4Ffq7YE:RU/NjjmT2SDdXk8FqbzX9S+2FfdFy
-
Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
-
Akira family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Renames multiple (8823) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell
Run Powershell command to delete shadowcopy.
-
Downloads MZ/PE file
-
Drops startup file
-
Drops desktop.ini file(s)
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1