TF-1901700 high

Description

Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Akira Stealer. Confidence: 95. First seen: 2026-09-05 20:17:53 UTC. Reporter: Grim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Akira Stealer. Confidence: 95. First seen: 2026-09-05 20:17:53 UTC. Reporter: Grim.

• MalwareBazaar | AkiraStealer
  web:bazaar.abuse.ch

  Malware samples associated with tag AkiraStealer MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with AkiraStealer . Database ...

  2026-09-06 05:48 UTC
• MalwareBazaar | akira - abuse.ch
  web:bazaar.abuse.ch

  Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with akira .

  2026-09-06 05:48 UTC
• Akira Ransomware: Attack Methods, IOCs and Defence 2026
  web:cybelangel.com

  Akira hit 84 victims in March 2026 and can encrypt a network in under an hour. How the attack chain works, CISA IOCs, and how to defend.

  2026-09-06 05:48 UTC
• security-research-labs/Threat-Intel/IOCs/Akira/README.md at main ...
  web:github.com

  IOC Package: Akira Ransomware — Case Notes ("Seven Seconds to Stop Akira ") Purpose: Indicators and incident context from a single defended-environment engagement, formatted for CTI and detection use. Malware sample is a per-victim build and may not match public corpus hashes.

  2026-09-06 05:48 UTC
• ThreatFox | Akira Stealer
  web:threatfox.abuse.ch

  A malware sample can be associated with only one malware family. The page below gives you an overview on indicators of compromise associated with py. akira_stealer .

  2026-09-06 05:48 UTC
• ThreatFox | 03f15483f39c480ebdcfe20891d6601c3800267c
  web:threatfox.abuse.ch

  Akira Stealer IOC: 03f15483f39c480ebdcfe20891d6601c3800267c ( sha1_hash ) You are viewing the ThreatFox database entry for sha1_hash ...

  2026-09-06 05:48 UTC
• #StopRansomware: Akira Ransomware - CISA
  web:www.cisa.gov

  Akira ransomware threat actors are associated with other groups known as Storm-1567, Howling Scorpius, Punk Spider, and Gold Sahara, and may have connections to the defunct Conti ransomware group. Akira threat actors primarily target small- and medium-sized businesses, but have also impacted larger organizations across various sectors.

  2026-09-06 05:48 UTC
• Akira Stealer : An Undetected Python Based Info-stealer
  web:www.cyfirma.com

  Akira is an information stealing malware being offered on a dedicated website as MaaS ( malware - as -a-service) with the tag " Akira Undetector". The web platform provides an interface to generate a new stealer binary with instructions to use the malware , leveraging the Telegram channel to provide updates and command-and-control functionality.

  2026-09-06 05:48 UTC
• Akira Stealer: Technical Analysis of a Modular Info-Stealing Malware ...
  web:www.glueckkanja.com

  The stealer script was invoked directly from disk, but all staging and execution logic remained embedded within the Electron bundle. In summary, main.exe served as the obfuscated, multi-layered execution core — acting as the gatekeeper between initial persistence and the full activation of the Akira Stealer payload in astor.py.

  2026-09-06 05:48 UTC
• Akira Ransomware: In-Depth Analysis, Detection, and Mitigation
  web:www.sentinelone.com

  Akira Ransomware uses multi-extortion tactics and a retro-styled leak site. Learn about its negotiation processes and how to mitigate it.

  2026-09-06 05:48 UTC

Only Available for Registered Users. Sign in to view.