TF-1885296
high
📛 Threat Title
Akira Stealer: MD5 hash of a malware sample (payload) 7e6bc763c08594604d8bd6c2bb55091e
Description
Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Akira Stealer. Confidence: 95. First seen: 2026-08-23 11:19:07 UTC. Reporter: Grim.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_md5
7e6bc763c08594604d8bd6c2bb55091e
VT 13 / 75
IOC database
- Type
- hash_md5
- Value
7e6bc763c08594604d8bd6c2bb55091e- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- MD5 hash of a malware sample (payload) attributed to Akira Stealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 13 of 75 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| Alibaba | malicious | Trojan:Script/Injector.b24889f6 |
| Antiy-AVL | malicious | Trojan/Script.Agent |
| DeepInstinct | malicious | MALICIOUS |
| DrWeb | malicious | JS.Packed.235 |
| ESET-NOD32 | malicious | Generik.MZBMKKO trojan |
| Malwarebytes | malicious | Spyware.InfoStealer.Electron |
| McAfeeD | malicious | ti!F63453A6624E |
| Rising | malicious | Trojan.Agent!8.B1E (CLOUD) |
| Sangfor | malicious | Trojan.Script.Agent.Vjve |
| Sophos | malicious | Mal/Generic-S |
| Symantec | malicious | Trojan.Gen.MBT |
| Tencent | malicious | Script.Trojan.Agent.Ocnw |
| Varist | malicious | W32/ABTrojan.FRJY-3534 |
Details From VirusTotal
Basic Properties
| MD5 | 7e6bc763c08594604d8bd6c2bb55091e |
| SHA-1 | 3d3af402b61751416191308d5756872d3a7423ce |
| SHA-256 | f63453a6624e55650957b76802c76c24678821a145694e8dc86b61ab19681e0b |
| VHash | 087056655d1c0510d043z800417z47z62z41fz |
| SSDEEP | 1572864:nLdkKuG/Z8Aa7BFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7N7:n2rLNaABZVPArg/bXeB7N7 |
| TLSH | T10A0833444B9A4626E1CFAFF8903F1DE2AE164CE0511EA4BB4657C076F5A18FBD25C20F |
| File type | Win32 EXE |
| File type tag | peexe |
| File extension | exe |
| Magic | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
| File size | 77.6 MB |
History
| Creation date | 2018-12-15 22:26 UTC |
| First seen on VirusTotal | 2026-08-13 08:44 UTC |
| Last submission | 2026-08-14 16:43 UTC |
| Last analysis | 2026-08-24 09:01 UTC |
| Last modified on VirusTotal | 2026-08-24 19:25 UTC |
Known Names
f63453a6624e55650957b76802c76c24678821a145694e8dc86b61ab19681e0b.exelauncher.exe
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Akira Stealer. Confidence: 95. First seen: 2026-08-23 11:19:07 UTC. Reporter: Grim.
Remediations (10)
-
web:bazaar.abuse.ch
Using the form below, you can search for malware samples by a hash ( MD5 , SHA256, SHA1), imphash, tlsh hash , ClamAV signature, tag or malware family. Browse Database
-
web:bazaar.abuse.ch
A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as Akira .
-
web:bazaar.abuse.ch
Malware samples associated with tag akira MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with akira . Database Entry
-
web:bazaar.abuse.ch
Malware samples associated with tag stealer MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with stealer . Database Entry
-
web:bazaar.abuse.ch
Information on AkiraStealer malware sample (SHA256 55039084acb6f9f7b765eaade72c37a70cf8c588b45caa272ffcca437668c578) MalwareBazaar uses YARA rules from several public ...
-
web:threatfox.abuse.ch
Using the form below, you can search for malware samples by a hash ( MD5 , SHA256, SHA1), imphash, tlsh hash , ClamAV signature, tag or malware family.
-
web:threatfox.abuse.ch
Akira Stealer IOC: 7e6bc763c08594604d8bd6c2bb55091e ( md5_hash ) You are viewing the ThreatFox database entry for md5_hash 7e6bc763c08594604d8bd6c2bb55091e .
-
web:www.cyfirma.com
Akira is an information stealing malware being offered on a dedicated website as MaaS ( malware - as -a-service) with the tag " Akira Undetector". The web platform provides an interface to generate a new stealer binary with instructions to use the malware , leveraging the Telegram channel to provide updates and command-and-control functionality.
-
web:www.glueckkanja.com
The stealer script was invoked directly from disk, but all staging and execution logic remained embedded within the Electron bundle. In summary, main.exe served as the obfuscated, multi-layered execution core — acting as the gatekeeper between initial persistence and the full activation of the Akira Stealer payload in astor.py.
-
web:www.scribd.com
The document reports the discovery of 17 new samples of Akira Ransomware, all sharing the same entry point and created on August 21, 2024. These samples , each sized at 1.02MB, began appearing between late September and December 2024, and are associated with specific mutexes linked to other malware . A list of MD5 hashes for the samples is also provided, along with a link to further resources.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.