TF-1844755
high
📛 Threat Title
Akira: MD5 hash of a malware sample (payload) 1ff7de4a7b52e02a211e39831061916f
Description
Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Akira (aliases: REDBIKE). Confidence: 75. First seen: 2026-07-04 16:17:47 UTC. Reporter: TheRavenFile. Tags: akira, Ransomware.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_md5
1ff7de4a7b52e02a211e39831061916f
IOC database
- Type
- hash_md5
- Value
1ff7de4a7b52e02a211e39831061916f- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- MD5 hash of a malware sample (payload) attributed to Akira
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (3)
- External reference ThreatFox IOCs
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Akira (aliases: REDBIKE). Confidence: 75. First seen: 2026-07-04 16:17:47 UTC. Reporter: TheRavenFile. Tags: akira, Ransomware.
Remediations (10)
-
web:attack.mitre.org
Akira ransomware employs hybrid encryption and threading to increase the speed and efficiency of encryption and runtime arguments for tailored attacks. Notable variants include Rust-based Megazord for targeting Windows and Akira _v2 for targeting VMware ESXi servers.
-
web:bazaar.abuse.ch
A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as Akira .
-
web:github.com
Akira A malware strain primarily designed for stealing cryptocurrency wallets and credentials from infected devices.
-
web:github.com
Contribute to rivitna/ Malware development by creating an account on GitHub.
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the Akira malware family including references, samples and yara signatures.
-
web:threatfox.abuse.ch
Akira IOC: b58814c0d3e05a164e26674647f331d5 ( md5_hash ) ThreatFox IOC Database You are viewing the ThreatFox database entry for md5_hash ...
-
web:www.cisa.gov
Akira ransomware threat actors are associated with other groups known as Storm-1567, Howling Scorpius, Punk Spider, and Gold Sahara, and may have connections to the defunct Conti ransomware group. Akira threat actors primarily target small- and medium-sized businesses, but have also impacted larger organizations across various sectors.
-
web:www.picussecurity.com
Learn how Akira ransomware operates in 2025 with updated CISA findings. Explore its latest TTPs, initial access methods, and actionable defense strategies.
-
web:www.sentinelone.com
Akira Ransomware uses multi-extortion tactics and a retro-styled leak site. Learn about its negotiation processes and how to mitigate it.
-
web:www.trellix.com
The compilation date of the analyzed sample is the 29th of July 2023, and it is a console application. Arguments to such an application are usually shared via the command-line and do not require a graphical interface of sorts. Akira supports a number of arguments, which instruct the malware to execute certain functions. Below, the options are ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.