Extracted

• • Target
    aa8a5bbbc87850c8bca34a53f13d4a89c04386fddfcadcc29f199fe7f2b52927
  • Size 36.0MB
  • SHA256 aa8a5bbbc87850c8bca34a53f13d4a89c04386fddfcadcc29f199fe7f2b52927
  • MD5 de2edbcc1f7475ff1bfe28f3e9bc77bc
  • SHA1 d6fdb35e68ae0c5acb7b17f454291fef69f30f67
  • SHA512 31098204297bfef70e8d457d1666453bd475134fca1b37073d805e5344f7f1fd235e8362b3580b46eac20da37ddaed5bc1c2106a060f00127fc7043d88a9e5fa
  • SSDEEP 393216:n1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfO:nMguj8Q4VfvSqFTrYG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionakira_stealerpersistencespywarestealertrojan

  • AkiraStealer

    AkiraStealer is an information stealer operating as a malware-as-a-service, written in Golang.

    stealerakira_stealer

  • Akira_stealer family

    akira_stealer

  • Detects GoLang version of AkiraStealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2