TF-1844734 high

Description

Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Akira (aliases: REDBIKE). Confidence: 75. First seen: 2026-07-04 16:17:43 UTC. Reporter: TheRavenFile. Tags: akira, Ransomware.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (3)

• External reference ThreatFox IOCs
• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Akira (aliases: REDBIKE). Confidence: 75. First seen: 2026-07-04 16:17:43 UTC. Reporter: TheRavenFile. Tags: akira, Ransomware.

• Akira, Software S1129 | MITRE ATT&CK®
  web:attack.mitre.org

  Akira ransomware employs hybrid encryption and threading to increase the speed and efficiency of encryption and runtime arguments for tailored attacks. Notable variants include Rust-based Megazord for targeting Windows and Akira _v2 for targeting VMware ESXi servers.

  2026-07-28 22:53 UTC
• MalwareBazaar | Browse malware samples - abuse.ch
  web:bazaar.abuse.ch

  Using the form below, you can search for malware samples by a hash ( MD5 , SHA256, SHA1), imphash, tlsh hash , ClamAV signature, tag or malware family. Browse Database

  2026-07-28 22:53 UTC
• MalwareBazaar | Akira
  web:bazaar.abuse.ch

  A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as Akira .

  2026-07-28 22:53 UTC
• Akira (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  Details for the Akira malware family including references, samples and yara signatures.

  2026-07-28 22:53 UTC
• #StopRansomware: Akira Ransomware - CISA
  web:www.cisa.gov

  Akira ransomware threat actors are associated with other groups known as Storm-1567, Howling Scorpius, Punk Spider, and Gold Sahara, and may have connections to the defunct Conti ransomware group. Akira threat actors primarily target small- and medium-sized businesses, but have also impacted larger organizations across various sectors.

  2026-07-28 22:53 UTC
• A spotlight on Akira ransomware from X-Force incident response ... - IBM
  web:www.ibm.com

  Figure 2: Akira ransomware .onion dark web negotiations portal (Source: X-Force dark web research) After gaining access, the negotiation portal displays a message telling the victim that the Akira group is preparing a sample of stolen data from the victim organization.

  2026-07-28 22:53 UTC
• Ransom:Win64/Akira.PB!MTB - microsoft.com
  web:www.microsoft.com

  This malware operates on a Ransomware- as -a-Service (RaaS) model, which allows multiple threat actors to conduct widespread attacks. Its primary method is a double-extortion strategy: threat actors first exfiltrate sensitive data from compromised networks and then deploy a payload to encrypt files on Windows devices.

  2026-07-28 22:53 UTC
• New Akira Ransomware Samples Identified | PDF - Scribd
  web:www.scribd.com

  The document reports the discovery of 17 new samples of Akira Ransomware, all sharing the same entry point and created on August 21, 2024. These samples , each sized at 1.02MB, began appearing between late September and December 2024, and are associated with specific mutexes linked to other malware . A list of MD5 hashes for the samples is also provided, along with a link to further resources.

  2026-07-28 22:53 UTC
• Akira Ransomware: In-Depth Analysis, Detection, and Mitigation
  web:www.sentinelone.com

  Akira Ransomware uses multi-extortion tactics and a retro-styled leak site. Learn about its negotiation processes and how to mitigate it.

  2026-07-28 22:53 UTC
• Akira Ransomware - Trellix
  web:www.trellix.com

  The compilation date of the analyzed sample is the 29th of July 2023, and it is a console application. Arguments to such an application are usually shared via the command-line and do not require a graphical interface of sorts. Akira supports a number of arguments, which instruct the malware to execute certain functions. Below, the options are ...

  2026-07-28 22:53 UTC

Only Available for Registered Users. Sign in to view.