TF-1885289
high
📛 Threat Title
Akira Stealer: SHA1 hash of a malware sample (payload) 03f15483f39c480ebdcfe20891d6601c3800267c
Description
Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Akira Stealer. Confidence: 95. First seen: 2026-08-23 11:19:04 UTC. Reporter: Grim.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha1
03f15483f39c480ebdcfe20891d6601c3800267c
VT 13 / 75
IOC database
- Type
- hash_sha1
- Value
03f15483f39c480ebdcfe20891d6601c3800267c- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- SHA1 hash of a malware sample (payload) attributed to Akira Stealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 13 of 75 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| Antiy-AVL | malicious | Trojan[Downloader]/Win64.Agent |
| DeepInstinct | malicious | MALICIOUS |
| DrWeb | malicious | Trojan.Siggen33.52020 |
| malicious | Detected |
|
| Kaspersky | malicious | Trojan-Downloader.Win64.Agent.fgj |
| Lionic | malicious | Trojan.Win32.AokigaharaStealer.4!c |
| Malwarebytes | malicious | Spyware.InfoStealer.Electron |
| McAfeeD | malicious | ti!73DE504B1D7C |
| Paloalto | malicious | generic.ml |
| Rising | malicious | Downloader.Agent!8.B23 (CLOUD) |
| Sophos | malicious | Mal/Generic-S |
| Symantec | malicious | Trojan.Gen.MBT |
| Varist | malicious | W32/ABmSpyware.LBKT-7081 |
Details From VirusTotal
Basic Properties
| MD5 | 8e7b9a5759e4cd645017aff73c5a0034 |
| SHA-1 | 03f15483f39c480ebdcfe20891d6601c3800267c |
| SHA-256 | 73de504b1d7c769d4d6bacd193b06f90aaf2fadb0fb7d2065eb02760d7074fde |
| VHash | 087056655d1c0550d043z800417z47z62z41fz |
| SSDEEP | 1572864:A12um44HiKXnzg1nNHG3cv4JW4/KMYAMvJmiftzjPzcsZM2AWUQriXyI:A1Tm4vT9NYJo+sUifljLcs22/W |
| TLSH | T11518338A7E21E47FF453D433E15C56E9725AF504AB338BA6203E80DEFCA27106F445A6 |
| File type | Win32 EXE |
| File type tag | peexe |
| File extension | exe |
| Magic | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
| File size | 81.1 MB |
History
| Creation date | 2018-12-15 22:26 UTC |
| First seen on VirusTotal | 2026-08-13 00:13 UTC |
| Last submission | 2026-08-24 05:06 UTC |
| Last analysis | 2026-08-24 09:01 UTC |
| Last modified on VirusTotal | 2026-08-24 16:45 UTC |
Known Names
73de504b1d7c769d4d6bacd193b06f90aaf2fadb0fb7d2065eb02760d7074fde.exev2.4.1.exe
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Akira Stealer. Confidence: 95. First seen: 2026-08-23 11:19:04 UTC. Reporter: Grim.
Remediations (10)
-
web:attack.mitre.org
Akira ransomware, written in C++, is most prominently (but not exclusively) associated with the ransomware- as -a-service entity Akira . Akira ransomware has been used in attacks across North America, Europe, and Australia, with a focus on critical infrastructure sectors including manufacturing, education, and IT services.
-
web:bazaar.abuse.ch
A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as Akira .
-
web:bazaar.abuse.ch
Malware samples associated with tag akira MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with akira . Database Entry
-
web:cybelangel.com
Akira malware only takes around 2 hours to steal data: It's been found that the Akira gang can run " lightning-fast data exfiltration " from Veeam servers. It's already claimed tens of millions: Akira generated $42 million in ransomware payments between March 2023 and April 2024 alone—and the number is likely to be much higher now.
-
web:threatfox.abuse.ch
Akira Stealer IOC: 03f15483f39c480ebdcfe20891d6601c3800267c ( sha1_hash ) You are viewing the ThreatFox database entry for sha1_hash ...
-
web:www.cisa.gov
Akira ransomware threat actors are associated with other groups known as Storm-1567, Howling Scorpius, Punk Spider, and Gold Sahara, and may have connections to the defunct Conti ransomware group. Akira threat actors primarily target small- and medium-sized businesses, but have also impacted larger organizations across various sectors.
-
web:www.cyfirma.com
Akira Stealer is an emerging stealer malware distributed under the guise of free premium software. It uses multi-level infection process for successful compromise and for obfuscation to avoid detection.
-
web:www.manageengine.com
Analyze Akira ransomware, its MITRE ATT&CK tactics, IOCs, attack chain, detection signals, and endpoint hardening recommendations.
-
web:www.researchgate.net
This paper presents an in-depth technical analysis of the Akira ransomware family, which has emerged as a prominent threat in the cybersecurity landscape between 2023 and 2025. Known for its ...
-
web:www.sentinelone.com
Akira Ransomware uses multi-extortion tactics and a retro-styled leak site. Learn about its negotiation processes and how to mitigate it.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.