General
-
Target
4f16317dba9b983bf494892dcd227c0795f3809303e3b2787bf0a2193a318e0c.exe
-
Size
1.0MB
-
Sample
250326-l49ssawqt8
-
MD5
d68c82bfa227f4f8e10f640d1c5b341e
-
SHA1
6c8f4ce06ea61feda5c70bf35ccc35fae5f20898
-
SHA256
4f16317dba9b983bf494892dcd227c0795f3809303e3b2787bf0a2193a318e0c
-
SHA512
1c0b69f8843b0ac0225054bfc04294de9e01f1fb167da43673c1577177ffcbfc98f5c5f483bd237c4f9273ec747774aae14dbfb6ee4929825378fa281df64733
-
SSDEEP
24576:zQagXrs6xiS7Ay/i4NBqThb23KAwcCcoVRqs:zQa36bg4NBqT1VAwfcoVx
Static task
static1
Behavioral task
behavioral1
Sample
4f16317dba9b983bf494892dcd227c0795f3809303e3b2787bf0a2193a318e0c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4f16317dba9b983bf494892dcd227c0795f3809303e3b2787bf0a2193a318e0c.exe
Resource
win10v2004-20250314-en
Malware Config
Extracted
C:\PerfLogs\Admin\akira_readme.txt
akira
https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/2142393226-WOTYM
Targets
-
-
Target
4f16317dba9b983bf494892dcd227c0795f3809303e3b2787bf0a2193a318e0c.exe
-
Size
1.0MB
-
MD5
d68c82bfa227f4f8e10f640d1c5b341e
-
SHA1
6c8f4ce06ea61feda5c70bf35ccc35fae5f20898
-
SHA256
4f16317dba9b983bf494892dcd227c0795f3809303e3b2787bf0a2193a318e0c
-
SHA512
1c0b69f8843b0ac0225054bfc04294de9e01f1fb167da43673c1577177ffcbfc98f5c5f483bd237c4f9273ec747774aae14dbfb6ee4929825378fa281df64733
-
SSDEEP
24576:zQagXrs6xiS7Ay/i4NBqThb23KAwcCcoVRqs:zQa36bg4NBqT1VAwfcoVx
-
Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
-
Akira family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Renames multiple (8643) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell
Run Powershell command to delete shadowcopy.
-
Drops startup file
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-