Akira ransomware continues to evolve

    Wednesday, October 23, 2024 In: Threat Research Print

    Date: 10/23/2024

    Severity: Critical 

    Summary

    Akira continues to establish itself as one of the most significant ransomware operations, as highlighted by Cisco Talos' findings. Their ongoing evolution contributes to their success; after releasing a new version of their encryptor earlier this year, they have introduced another iteration that targets both Windows and Linux systems. Initially, Akira used a double-extortion method, exfiltrating critical data before encrypting victim systems. However, since early 2024, they have shifted focus solely to data exfiltration, likely allowing time to enhance their encryptor while also developing a Rust variant of their ESXi encryptor.

    Indicators of Compromise (IOC) List

    Hash :

    78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0

2c7aeac07ce7f03b74952e0e243bd52f2bfa60fadc92dd71a6a1fee2d14cdd77

88da2b1cee373d5f11949c1ade22af0badf16591a871978a9e02f70480e547b2

566ef5484da0a93c87dd0cb0a950a7cff4ab013175289cd5fccf9dd7ea430739

ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5

87b4020bcd3fad1f5711e6801ca269ef5852256eeaf350f4dde2dc46c576262d

988776358d0e45a4907dc1f4906a916f1b3595a31fa44d8e04e563a32557eb42

3805f299d33ef43d17a5a1040149f0e5e2d5db57ec6f03c5687ac23db1f77a30

abba655df92e99a15ddcde1d196ff4393a13dbff293e45f5375a2f61c84a2c7b

a546ef13e8a71a8b5f0803075382eb0311d0d8dbae3f08bac0b2f4250af8add0

6005dcbe15d60293c556f05e98ed9a46d398a82e5ca4d00c91ebec68a209ea84

43c5a487329f5d6b4a6d02e2f8ef62744b850312c5cb87c0a414f3830767be72

8e9a33809b9062c5033928f82e8adacbef6cd7b40e73da9fcf13ec2493b4544c

bcae978c17bcddc0bf6419ae978e3471197801c36f73cff2fc88cecbe3d88d1a

3805f299d33ef43d17a5a1040149f0e5e2d5db57ec6f03c5687ac23db1f77a30

678ec8734367c7547794a604cc65e74a0f42320d85a6dce20c214e3b4536bb33

6cadab96185dbe6f3a7b95cf2f97d6ac395785607baa6ed7bf363deeb59cc360

3c92bfc71004340ebc00146ced294bc94f49f6a5e212016ac05e7d10fcb3312c

1b6af2fbbc636180dd7bae825486ccc45e42aefbb304d5f83fafca4d637c13cc

5c62626731856fb5e669473b39ac3deb0052b32981863f8cf697ae01c80512e5

dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc53198

28cea00267fa30fb63e80a3c3b193bd9cd2a3d46dd9ae6cede5f932ac15c7e2e

a6b0847cf31ccc3f76538333498f8fef79d444a9d4ecfca0592861cf731ae6cb

b55fbe9358dd4b5825ce459e84cd0823ecdf7b64550fe1af968306047b7de5c9

c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b3898b0

0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd9438696d

95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280e8ec5a

e3fa93dad8fb8c3a6d9b35d02ce97c22035b409e0efc9f04372f4c1d6280a481

68d5944d0419bd123add4e628c985f9cbe5362ee19597773baea565bff1a6f1a

8816caf03438cd45d7559961bf36a26f26464bab7a6339ce655b7fbad68bb439

c0c0b2306d31e8962973a22e50b18dfde852c6ddf99baf849e3384ed9f07a0d6

7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beeddb3760be

2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c83

9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e04426c

9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f23d065

131da83b521f610819141d5c740313ce46578374abb22ef504a7593955a65f07

3298d203c2acb68c474e5fdad8379181890b4403d6491c523c13730129be3f75

0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df282796c

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Hash :

    sha256hash IN ("e3fa93dad8fb8c3a6d9b35d02ce97c22035b409e0efc9f04372f4c1d6280a481","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e04426c","3805f299d33ef43d17a5a1040149f0e5e2d5db57ec6f03c5687ac23db1f77a30","678ec8734367c7547794a604cc65e74a0f42320d85a6dce20c214e3b4536bb33","988776358d0e45a4907dc1f4906a916f1b3595a31fa44d8e04e563a32557eb42","28cea00267fa30fb63e80a3c3b193bd9cd2a3d46dd9ae6cede5f932ac15c7e2e","c0c0b2306d31e8962973a22e50b18dfde852c6ddf99baf849e3384ed9f07a0d6","6cadab96185dbe6f3a7b95cf2f97d6ac395785607baa6ed7bf363deeb59cc360","a546ef13e8a71a8b5f0803075382eb0311d0d8dbae3f08bac0b2f4250af8add0","2c7aeac07ce7f03b74952e0e243bd52f2bfa60fadc92dd71a6a1fee2d14cdd77","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c83","43c5a487329f5d6b4a6d02e2f8ef62744b850312c5cb87c0a414f3830767be72","6005dcbe15d60293c556f05e98ed9a46d398a82e5ca4d00c91ebec68a209ea84","566ef5484da0a93c87dd0cb0a950a7cff4ab013175289cd5fccf9dd7ea430739","a6b0847cf31ccc3f76538333498f8fef79d444a9d4ecfca0592861cf731ae6cb","68d5944d0419bd123add4e628c985f9cbe5362ee19597773baea565bff1a6f1a","b55fbe9358dd4b5825ce459e84cd0823ecdf7b64550fe1af968306047b7de5c9","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c13730129be3f75","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beeddb3760be","87b4020bcd3fad1f5711e6801ca269ef5852256eeaf350f4dde2dc46c576262d","88da2b1cee373d5f11949c1ade22af0badf16591a871978a9e02f70480e547b2","78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df282796c","ccda8247360a85b6c076527e438a995757b6cdf5530f38e125915d31291c00d5","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280e8ec5a","3c92bfc71004340ebc00146ced294bc94f49f6a5e212016ac05e7d10fcb3312c","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd9438696d","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc53198","8e9a33809b9062c5033928f82e8adacbef6cd7b40e73da9fcf13ec2493b4544c","abba655df92e99a15ddcde1d196ff4393a13dbff293e45f5375a2f61c84a2c7b","bcae978c17bcddc0bf6419ae978e3471197801c36f73cff2fc88cecbe3d88d1a","1b6af2fbbc636180dd7bae825486ccc45e42aefbb304d5f83fafca4d637c13cc","5c62626731856fb5e669473b39ac3deb0052b32981863f8cf697ae01c80512e5","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b3898b0","8816caf03438cd45d7559961bf36a26f26464bab7a6339ce655b7fbad68bb439","131da83b521f610819141d5c740313ce46578374abb22ef504a7593955a65f07")

    Reference:

    https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/ 


    Tags

    MalwareRansomwareAkira

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2024 by Gurucul - All rights reserved.