Akira Ransomware

April 2023 has brought about a new ransom group called Akira. This post serves as a consolidation of public intel to help filter through the searches for Akira that just result in anime :-).

IOCS

7b295a10d54c870d59fab3a83a8b983282f6250a0be9df581334eb93d53f3488
3c92bfc71004340ebc00146ced294bc94f49f6a5e212016ac05e7d10fcb3312c
w.exe

Twitter Posts:

#Akira is another strange #ransomware.
I wonder why Akira's author made the parameter "encryption_percent". The default value of this parameter is set to 50.
If you change this value, then part of block will be encrypted multiple times 🙂https://t.co/XzHALhiG5z pic.twitter.com/kABM0pyzLz
— rivitna (@rivitna2) April 29, 2023

#Akira ransomware is based on source code of Conti ransomware. It is apparent that the same obfuscation technique has been employed by the Akira group to obscure strings. It is worth noting that in the past, the Lockbit green based on conti source code. https://t.co/D2o4oUQ63R pic.twitter.com/arHPFRpAvH
— Gameel Ali 🤘 (@MalGamy12) April 28, 2023

#Akira ransomware seems to be new, multiple victims in the last week. Attacks fairly simple, including Process Hacker, PC Hunter, Lsass dumps, enabling remote registry. Ransomware exe dropped into multiple locations. Leak site is a bit different, commands instead of links. pic.twitter.com/EmGcOFtpxY
— PeterM🌻 (@AltShiftPrtScn) April 6, 2023

Leave a Reply Cancel reply