s2
--:--:--UTC

Searching APEX

Starting…

  1. Searching Threats, IOCs & Threat Intelligence locally
  2. Querying external providers
  3. Asking AI Forensic Validator
  4. Creating new entry from validated hit

0s elapsed

TF-1844762 high

📛 Threat Title

Akira: MD5 hash of a malware sample (payload) e48e6c4a26379e2cf4a8e8c9a59ef094

Category: Akira Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Akira (aliases: REDBIKE). Confidence: 75. First seen: 2026-07-04 16:17:47 UTC. Reporter: TheRavenFile. Tags: akira, Ransomware.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_md5 e48e6c4a26379e2cf4a8e8c9a59ef094

IOC database

Type
hash_md5
Value
e48e6c4a26379e2cf4a8e8c9a59ef094
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
MD5 hash of a malware sample (payload) attributed to Akira

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (3)

  • External reference ThreatFox IOCs
  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Akira (aliases: REDBIKE). Confidence: 75. First seen: 2026-07-04 16:17:47 UTC. Reporter: TheRavenFile. Tags: akira, Ransomware.

Remediations (10)

  • web:attack.mitre.org

    Akira ransomware, written in C++, is most prominently (but not exclusively) associated with the ransomware- as -a-service entity Akira . Akira ransomware has been used in attacks across North America, Europe, and Australia, with a focus on critical infrastructure sectors including manufacturing, education, and IT services.

  • web:bazaar.abuse.ch

    A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as Akira .

  • web:bazaar.abuse.ch

    Malware samples associated with tag akira MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with akira . Database Entry

  • web:malpedia.caad.fkie.fraunhofer.de

    Details for the Akira malware family including references, samples and yara signatures.

  • web:threatfox.abuse.ch

    Akira IOC: 1d895cf4391b817e54fb9ec9d8e65f7e ( md5_hash ) ThreatFox IOC Database You are viewing the ThreatFox database entry for md5_hash ...

  • web:threatfox.abuse.ch

    Akira IOC: b58814c0d3e05a164e26674647f331d5 ( md5_hash ) ThreatFox IOC Database You are viewing the ThreatFox database entry for md5_hash ...

  • web:www.cisa.gov

    Analysts first identified Akira threat actors deploying the Windows-specific "Megazord" ransomware, and further investigation revealed the threat actors concurrently deployed a second payload during the attack, later identified as a novel variant of the Akira ESXi encryptor, Akira_v2.

  • web:www.researchgate.net

    This paper presents an in-depth technical analysis of the Akira ransomware family, which has emerged as a prominent threat in the cybersecurity landscape between 2023 and 2025. Known for its ...

  • web:www.scribd.com

    The document reports the discovery of 17 new samples of Akira Ransomware, all sharing the same entry point and created on August 21, 2024. These samples , each sized at 1.02MB, began appearing between late September and December 2024, and are associated with specific mutexes linked to other malware . A list of MD5 hashes for the samples is also provided, along with a link to further resources.

  • web:www.trellix.com

    About Akira The ransomware's name likely comes from an 1988 anime movie with the same name (spoilers ahead). The movie's cyberpunk aesthetic is emulated by the ransom group on their leak site, as can be seen on the image below, courtesy of BleepingComputer. Figure 1: The Akira leak site The movie is set in Neo-Tokyo, which was built after Akira destroyed the city. In the movie, Akira ...

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.