TF-1885295
high
📛 Threat Title
Akira Stealer: SHA1 hash of a malware sample (payload) 3d3af402b61751416191308d5756872d3a7423ce
Description
Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Akira Stealer. Confidence: 95. First seen: 2026-08-23 11:19:07 UTC. Reporter: Grim.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha1
3d3af402b61751416191308d5756872d3a7423ce
VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/3d3af402b61751416191308d5756872d3a7423ce
IOC database
- Type
- hash_sha1
- Value
3d3af402b61751416191308d5756872d3a7423ce- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- SHA1 hash of a malware sample (payload) attributed to Akira Stealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/3d3af402b61751416191308d5756872d3a7423ce
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Akira Stealer. Confidence: 95. First seen: 2026-08-23 11:19:07 UTC. Reporter: Grim.
Remediations (10)
-
web:attack.mitre.org
Akira ransomware, written in C++, is most prominently (but not exclusively) associated with the ransomware- as -a-service entity Akira . Akira ransomware has been used in attacks across North America, Europe, and Australia, with a focus on critical infrastructure sectors including manufacturing, education, and IT services.
-
web:bazaar.abuse.ch
A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as Akira .
-
web:bazaar.abuse.ch
Malware samples associated with tag akira MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with akira . Database Entry
-
web:cybelangel.com
Akira hit 84 victims in March 2026 and can encrypt a network in under an hour. How the attack chain works, CISA IOCs, and how to defend.
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the Akira malware family including references, samples and yara signatures.
-
web:threatfox.abuse.ch
Akira Stealer IOC: 3d3af402b61751416191308d5756872d3a7423ce ( sha1_hash ) You are viewing the ThreatFox database entry for sha1_hash ...
-
web:www.cisa.gov
Akira ransomware threat actors are associated with other groups known as Storm-1567, Howling Scorpius, Punk Spider, and Gold Sahara, and may have connections to the defunct Conti ransomware group. Akira threat actors primarily target small- and medium-sized businesses, but have also impacted larger organizations across various sectors.
-
web:www.cyfirma.com
Akira is an information stealing malware being offered on a dedicated website as MaaS ( malware - as -a-service) with the tag " Akira Undetector". The web platform provides an interface to generate a new stealer binary with instructions to use the malware , leveraging the Telegram channel to provide updates and command-and-control functionality.
-
web:www.glueckkanja.com
The stealer script was invoked directly from disk, but all staging and execution logic remained embedded within the Electron bundle. In summary, main.exe served as the obfuscated, multi-layered execution core — acting as the gatekeeper between initial persistence and the full activation of the Akira Stealer payload in astor.py.
-
web:www.sentinelone.com
Akira Ransomware uses multi-extortion tactics and a retro-styled leak site. Learn about its negotiation processes and how to mitigate it.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.