Malware Spotlight: Akira Ransomware

Incident Response Data on the Akira Ransomware Group

 

The information below is based on engagements involving Akira ransomware investigated by Arete since April 2023. Our IR, Threat Intelligence, and Data Analytics teams work together to analyze key data points during every ransomware engagement and form real-time threat actor (TA) insights.

 

Technical Analysis

 
Malware analysis of one of the Windows-based variants revealed that Akira ransomware:
 

Command line argument	Description
-p / –encryption_path	Specify a target directory to encrypt. If not provided, the payload will encrypt the local and mounted shared drives by default.
-s / –share_file	Encrypt shared volumes/directory files.
-n / –encryption_percent	Number that represents the percentage of the file that will be encrypted.
-localonly	Encrypt only local volumes.
-e/ –exclude	Meant to exclude directories but does not seem to be fully functional.

Command line argument	Description
–path	Path to encrypt. If not provided, the payload will encrypt the local and mounted shared drives by default.
–id	Unique token to execute the ransomware.
–threads	Number of threads (1-1000).
–h (–help)	Displays help options.
-log	Logging options with multiple logs supported (info, error, debug). Not displayed by default.

Akira.exe -p=C:\Users\%USERNAME%\Desktop\MyFiles

Akira.exe –encryption_percent=10

explorer.exe, sihost.exe, spoolsv.exe, dwm.exe, LogonUI.exe, fontdrvhost.exe, cmd.exe, csrss.exe, smss.exe, SearchUI.exe, lsass.exe, conhost.exe, System, winlogon.exe, services.exe, wininit.exe, Registry, Memory Compression, System Idle Process, Secure System

.exe, .dll, .sys, .msi, .lnk, .akira, akira_readme.txt

tmp, temp, winnt, $Recycle.Bin, thumb, System Volume Information, $RECYCLE.BIN, Windows, ProgramData, Trend Micro, ProgramData, Boot

powershell.exe -Command “Get-WmiObject Win32_Shadowcopy | Remove-WmiObject”

Hi friends,
 
Whatever who you are and what your title is if you’re reading this it means the internal infrastructure of your company is fully or partially dead, all your backups – virtual, physical – everything that we managed to reach – are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption.
 
Well, for now let’s keep all the tears and resentment to ourselves and try to build a constructive dialogue. We’re fully aware of what damage we caused by locking your internal sources. At the moment, you have to know:
 

1. Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal.
2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them – in this case we won’t be able to help.
3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we’ve managed to detect and used in order to get into, identify backup solutions and upload your data.
4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes – generally speaking, everything that has a value on the darkmarket – to multiple threat actors at ones. Then all of this will be published in our blog – https://akiraI2iz6a7qgd3ayp3I6yub7xx2uep76idk3u2kolIpj5z3z636bad[.]onion
5. We’re more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.

 
If you’re indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:
 

1. Install TOR Browser to get access to our chat room – https://www.torproject.org/download/.
2. Paste this link – <ONION_LINK>
3. Use this code – <UNIQUE_CODE> – to log into our chat.

 
Keep in mind that the faster you will get in touch, the less damage we cause.

Indicator	Type	Context
9f873c29a38dd265decb6517a2a1f3b5d4f90ccd42e-b61039086ea0b5e74827e	SHA256 hash	Akira ransomware
2b00a02196b87445633cabde506b4387979504cf60955f0b-40cf2e4da4f0fd23	SHA256 hash	Akira ransomware
237d3c744fd5fc5d7e7a55e4385dff51045a1c6d8ee-7346a270a688ab3791d49	SHA256 hash	Akira ransomware
akira_readme.txt, powerranges.txt	File name	Akiraransom notes
.akira, .powerranges, .akiranew	Extension	Encrypted files extension
powershell.exe -Command “Get-WmiObject Win32_Shadowcopy | Remove-WmiObject”	Process	Volume Shadow Copy deletion
Log-19-09-2024-09-21-20.txt	File name	Example log file name created by Akira
https://akirai2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kolIpj5z3z636bad[.]onion	URL	TA data leak site (DLS)

SentinelOne S1QL 1.0 query syntax (STAR rule):
Volume Shadow Copy Deletion

EndpointOS = "windows" AND ObjectType = "process" AND TgtProcCmdLine Contains Anycase "powershell.exe" 
AND TgtProcCmdLine Contains Anycase "-Command" 
AND TgtProcCmdLine Contains Anycase "Get-WmiObject Win32_Shadowcopy |" 
AND TgtProcCmdLine Contains Anycase "Remove-WmiObject"

Akira Ransomware

EndpointOS = "windows" AND ((ObjectType = "process" AND CmdLine In Contains Anycase (
".\ProgramData\w.exe", ":\w.exe", ":\ProgramData\win.exe", ":\programdata\lck.exe", 
":\ProgramData\dllhost32.exe", ":\ProgramData\hpupdate.exe")) 
OR (ObjectType = "file" AND (EventType In ("File Creation", "File Scan") AND 
(TgtFilePath In Contains Anycase (":\ProgramData\w.exe", ":\w.exe", ":\ProgramData\win.exe", 
":\programdata\lck.exe", ":\ProgramData\dllhost32.exe", ":\ProgramData\hpupdate.exe", 
":\akira_readme.txt", ":\powerranges.txt", "akiranew.txt") OR TgtFilePath RegExp 
"\\Log-[0-9]{2}-[0-9]{2}-20[0-9]{2}-[0-9]{2}-[0-9]{2}\.txt$"))))

Note: These threat hunting queries may need to be tuned for your specific network environment.

rule Akira_ransomware_executable
{
    meta:
        author = "areteir.com"
        description = "Detects the Akira ransomware executable"
        target = "Windows systems"
        file_type = "exe"
        copyright = "Copyright © 2024 by Arete Advisors, LLC."
        distribution = "No re-distribution without Arete Advisors, LLC consent."

    strings:
        $ns1 = "Shadowcopy" ascii wide nocase
        $ns2 = "Remove-WmiObject" ascii wide nocase
        $ns3 = "write_encrypt_info" ascii wide nocase
        $ns4 = "Log-%d-%m-%Y-%H-%M-%S" ascii wide nocase
        $as1 = "--encryption_path" ascii wide nocase
        $as2 = "--share_file" ascii wide nocase
        $as3 = "--encryption_percent" ascii wide nocase
        $as4 = "-localonly" ascii wide nocase
        $ms1 = "megazord\\src\\main.rs" ascii wide nocase
        $ms2 = "megazord::windowsmegazord\\src\\windows.rs" ascii wide nocase
        $ms3 = "megazord::path_findermegazord\\src\\path_finder.rs" ascii wide nocase
        $ms4 = "megazord\\src\\lock.rs" ascii wide nocase
        $pdb1 = ":\\rust\\megazord" ascii wide nocase
        $pdb2 = "\\release\\deps\\megazord.pdb" ascii wide nocase
        $dls = "akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad" ascii wide nocase

condition:
((uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550)) and
( ( (2 of ($ns*)) and (3 of ($as*)) ) or ( all of ($ms*) ) or ( all of ($pdb*) ) or ($dls) )
}

Recommended Mitigations

 

Arete provides data-driven cybersecurity solutions to transform your response to emerging cyber threats.
Click here to learn more.

At Arete, we envision a world without cyber extortion, where people, businesses, and governments can thrive. We are taking all that we know from over 9,000 engagements to inform our solutions and strengthen powerful tools to better prevent, detect, and respond to the cyber extortion threats of tomorrow. Our elite team of experts provides unparalleled capabilities to address the entire cyber threat lifecycle, from incident response and restoration to advisory and managed security services. To learn more about our solutions, visit www.areteir.com.