TF-1901701
high
📛 Threat Title
Akira Stealer: MD5 hash of a malware sample (payload) f398eabde69bc3369038f987fcc17bd4
Description
Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Akira Stealer. Confidence: 95. First seen: 2026-09-05 20:17:53 UTC. Reporter: Grim.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_md5
f398eabde69bc3369038f987fcc17bd4
IOC database
- Type
- hash_md5
- Value
f398eabde69bc3369038f987fcc17bd4- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- MD5 hash of a malware sample (payload) attributed to Akira Stealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Akira Stealer. Confidence: 95. First seen: 2026-09-05 20:17:53 UTC. Reporter: Grim.
Remediations (10)
-
web:bazaar.abuse.ch
A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as Akira .
-
web:bazaar.abuse.ch
Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with akira .
-
web:gbhackers.com
Akira Stealer contains a multi-level infection process for code obfuscation and detection evasion, found to be providing services.
-
web:ismalicious.com
553 indicators of compromise attributed to the Akira malware family — domains, IPs, URLs and file hashes, from abuse.ch feeds.
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the Akira malware family including references, samples and yara signatures.
-
web:threatfox.abuse.ch
Akira Stealer IOC: 8e7b9a5759e4cd645017aff73c5a0034 ( md5_hash ) You are viewing the ThreatFox database entry for md5_hash 8e7b9a5759e4cd645017aff73c5a0034.
-
web:threatfox.abuse.ch
Akira Stealer IOC: 7e6bc763c08594604d8bd6c2bb55091e ( md5_hash ) False positives reports are handled by the Spamhaus Project. In case you provide your email address ...
-
web:www.cyfirma.com
Akira Stealer is an emerging stealer malware distributed under the guise of free premium software. It uses multi-level infection process for successful compromise and for obfuscation to avoid detection.
-
web:www.glueckkanja.com
The stealer script was invoked directly from disk, but all staging and execution logic remained embedded within the Electron bundle. In summary, main.exe served as the obfuscated, multi-layered execution core — acting as the gatekeeper between initial persistence and the full activation of the Akira Stealer payload in astor.py.
-
web:www.scribd.com
The document reports the discovery of 17 new samples of Akira Ransomware, all sharing the same entry point and created on August 21, 2024. These samples , each sized at 1.02MB, began appearing between late September and December 2024, and are associated with specific mutexes linked to other malware . A list of MD5 hashes for the samples is also provided, along with a link to further resources.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.