s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-2013323 high

📛 Threat Title

Akira Stealer: MD5 hash of a malware sample (payload) 6efe5b9d8e5e03e4ea2a43e0a49e57d6

Category: Akira Stealer Published: Source updated: First seen: Last updated: Source: Threatfox IOCs/Threats

Description

Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Akira Stealer. Confidence: 95. First seen: 2026-11-03 16:42:44 UTC. Reporter: Grim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_md5 6efe5b9d8e5e03e4ea2a43e0a49e57d6 VT 22 / 75

IOC database

Type
hash_md5
Value
6efe5b9d8e5e03e4ea2a43e0a49e57d6
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
MD5 hash of a malware sample (payload) attributed to Akira Stealer

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 22 of 75 VirusTotal vendors

VendorVerdictDetection
Avast malicious FileRepMalware [Pws]
AVG malicious FileRepMalware [Pws]
Avira malicious TR/W64.Evo
Bkav malicious W32.Malware.31D82DB0
CrowdStrike malicious win/malicious_confidence_60% (W)
Elastic malicious malicious (high confidence)
ESET-NOD32 malicious WinGo/Kryptik.AFB trojan
Fortinet malicious W64/Vidar.YI!tr
GData malicious Win32.Trojan-Stealer.CredStealer.T7DCL1
Gridinsoft malicious Trojan.Win64.Wacatac.cl
Kaspersky malicious UDS:Trojan-PSW.Win64.BroPass
Kingsoft malicious Win64.Trojan-PSW.BroPass.a
Lionic malicious Trojan.Win32.BroPass.i!c
Malwarebytes malicious Malware.AI.2040368688
McAfeeD malicious ti!AD9A979E68A4
Microsoft malicious Trojan:Win32/Wacatac.B!ml
Paloalto malicious generic.ml
Skyhigh malicious Artemis!Trojan
Sophos malicious Mal/Generic-S
Symantec malicious ML.Attribute.HighConfidence
TrellixENS malicious Artemis!6EFE5B9D8E5E
Varist malicious W64/WinGo.J.gen!Eldorado

Details From VirusTotal

Basic Properties
MD56efe5b9d8e5e03e4ea2a43e0a49e57d6
SHA-1b0fed7064900e9c3a4ec2585f3baa49a03ad2853
SHA-256ad9a979e68a411ca15f5d003c37ada725d02c34d6c1b7f34c4dbbbed39a8dd4f
VHash017086651d55551d15545az2e!z
SSDEEP49152:11suvbC82UYzgu8bZgoGgq2kKy1PCeCbnEK2zyBVb2NW0FGMC9GzpRd4gO0LTzwp:1gjXKyhQVItS2A9Sy
TLSHT12BA63A03BA6902E5C4959E34C97F5263AA24BC8CDB3573D32E4075742F7ABD0BAB9704
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32+ executable (GUI) x86-64, for MS Windows
File size9.9 MB
History
First seen on VirusTotal2026-11-02 17:31 UTC
Last submission2026-11-03 16:12 UTC
Last analysis2026-11-03 00:03 UTC
Last modified on VirusTotal2026-11-03 20:38 UTC
Known Names
  • ad9a979e68a411ca15f5d003c37ada725d02c34d6c1b7f34c4dbbbed39a8dd4f.exe
  • glaicer.exe
  • qd791.exe

References (2)

  • Malpedia profile Threatfox IOCs/Threats
  • ThreatFox IOC page Threatfox IOCs/Threats

    Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Akira Stealer. Confidence: 95. First seen: 2026-11-03 16:42:44 UTC. Reporter: Grim.

Remediations (10)

  • MalwareBazaar | Akira
    web:bazaar.abuse.ch

    A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as Akira .

  • MalwareBazaar | akira - abuse.ch
    web:bazaar.abuse.ch

    Malware samples associated with tag akira MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with akira . Database Entry

  • Malware-Samples/Samples/Akira at main · Cybersight-Security ... - GitHub
    web:github.com

    Akira A malware strain primarily designed for stealing cryptocurrency wallets and credentials from infected devices.

  • Malware/Akira/akira_decrypt_file.py at main · rivitna/Malware
    web:github.com

    Malware / Akira / akira_decrypt_file.py rivitna Update akira_decrypt_file.py c982ed3 · 3 years ago History 185 lines (142 loc) · 5.01 KB

  • Akira Stealer malware sample 73de504b1d7c769d… | isMalicious
    web:ismalicious.com

    Akira Stealer malware sample 73de504b1d7c769d4d6bacd193b06f90aaf2fadb0fb7d2065eb02760d7074fde: threat listings, file type, antivirus signatures, public reports and its MD5 , SHA-1 and SHA-256, from the isMalicious threat intelligence dataset.

  • Akira Stealer malware sample c42e431a727120c9… | isMalicious
    web:ismalicious.com

    Akira Stealer sample c42e431a727120c9da477c32f1ffe0b5ac46805ff7bc0516252da29a0d172bcd: listed by 2 threat sources ( malware , c2). File type, signatures, hashes, reports.

  • ThreatFox | b57099b095ed6f665ea8e768f3c6d1d1
    web:threatfox.abuse.ch

    Akira Stealer IOC: b57099b095ed6f665ea8e768f3c6d1d1 ( md5_hash ) You are viewing the ThreatFox database entry for md5_hash b57099b095ed6f665ea8e768f3c6d1d1.

  • ThreatFox | 73e53595593b6b687f041c8e107f4165
    web:threatfox.abuse.ch

    Akira Stealer IOC: 73e53595593b6b687f041c8e107f4165 ( md5_hash ) You are viewing the ThreatFox database entry for md5_hash 73e53595593b6b687f041c8e107f4165.

  • Akira Stealer : An Undetected Python Based Info-stealer
    web:www.cyfirma.com

    Akira is an information stealing malware being offered on a dedicated website as MaaS ( malware - as -a-service) with the tag " Akira Undetector". The web platform provides an interface to generate a new stealer binary with instructions to use the malware , leveraging the Telegram channel to provide updates and command-and-control functionality.

  • Akira Stealer: Technical Analysis of a Modular Info-Stealing Malware ...
    web:www.glueckkanja.com

    The stealer script was invoked directly from disk, but all staging and execution logic remained embedded within the Electron bundle. In summary, main.exe served as the obfuscated, multi-layered execution core — acting as the gatekeeper between initial persistence and the full activation of the Akira Stealer payload in astor.py.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.