s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-1988795 high

📛 Threat Title

Akira Stealer: SHA1 hash of a malware sample (payload) 255bce3c36ae07ca09fe08865dce6f04cd460f14

Category: Akira Stealer Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Akira Stealer. Confidence: 95. First seen: 2026-10-25 17:41:27 UTC. Reporter: Grim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha1 255bce3c36ae07ca09fe08865dce6f04cd460f14 VT 29 / 75

IOC database

Type
hash_sha1
Value
255bce3c36ae07ca09fe08865dce6f04cd460f14
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
SHA1 hash of a malware sample (payload) attributed to Akira Stealer

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 29 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious Trojan[stealer]:Multi/Wacatac.B9nj
Avast malicious Win64:Evo-gen [Trj]
AVG malicious Win64:Evo-gen [Trj]
Avira malicious TR/W64.Evo
Bkav malicious W32.Malware.2243D707
CrowdStrike malicious win/malicious_confidence_60% (W)
Cynet malicious Malicious (score: 99)
DeepInstinct malicious MALICIOUS
Elastic malicious malicious (high confidence)
ESET-NOD32 malicious WinGo/GenKryptik.HVTH trojan
F-Secure malicious Trojan.TR/W64.Evo
Fortinet malicious W64/Vidar.YI!tr
Google malicious Detected
Ikarus malicious Trojan-Spy.Win64.Agent
Kaspersky malicious UDS:Trojan-PSW.Win64.BroPass
Kingsoft malicious Win32.Trojan-PSW.Agent.gen
Lionic malicious Trojan.Win32.Agent.Y!c
Malwarebytes malicious Malware.AI.2957342724
MaxSecure malicious Trojan.Malware.121218.susgen
McAfeeD malicious ti!CCD8C73DC516
Microsoft malicious Trojan:Win32/Wacatac.B!ml
Paloalto malicious generic.ml
Panda malicious Trj/PhxBzA.A
Sangfor malicious Trojan.Win32.Evo.Vutu
Sophos malicious Mal/Generic-S
Symantec malicious ML.Attribute.HighConfidence
Tencent malicious Win32.Trojan.FalseSign.Lcnw
TrellixENS malicious Artemis!29F0A08ECF6D
Varist malicious W64/WinGo.J.gen!Eldorado

Details From VirusTotal

Basic Properties
MD529f0a08ecf6d5d857bc42ab0c55c3ad8
SHA-1255bce3c36ae07ca09fe08865dce6f04cd460f14
SHA-256ccd8c73dc516f01fc03978265e62025415550ad423d7cfe8fbc16f4417467c39
VHash056086651d15551d15545az2e!z
SSDEEP49152:jcbj32Zp9c5s0RDfiQ8p78001PxN7lqRQdh8qeCmt2PdSJJbWLeLVKFiDG4ZAWht:jpO5s0YqtItIc5
TLSHT146462807BB9455E8C096EA38C4BA4653B7607C8CC33277E72E51AB742F757D0AA39B04
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32+ executable (GUI) x86-64, for MS Windows
File size5.4 MB
History
First seen on VirusTotal2026-10-25 14:58 UTC
Last submission2026-10-25 16:00 UTC
Last analysis2026-10-25 18:03 UTC
Last modified on VirusTotal2026-10-25 20:12 UTC
Known Names
  • rh7d1gr9.exe
  • glaicer.exe

References (2)

  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Akira Stealer. Confidence: 95. First seen: 2026-10-25 17:41:27 UTC. Reporter: Grim.

Remediations (10)

  • MalwareBazaar | Akira
    web:bazaar.abuse.ch

    A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as Akira .

  • MalwareBazaar | akira - abuse.ch
    web:bazaar.abuse.ch

    Malware samples associated with tag akira MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with akira . Database Entry

  • Malware/Akira/Akira_samples.txt at main · rivitna/Malware
    web:github.com

    Contribute to rivitna/ Malware development by creating an account on GitHub.

  • Malware Hash Lookup — Check MD5, SHA-1 & SHA-256
    web:imalware.com

    It compares a file's fingerprint (its MD5, SHA-1 or SHA-256 hash ) with a list of fingerprints of known malware . If the hash matches, the file is identical to a known malicious sample .

  • Akira Stealer malware sample 8c827ebe6affd137… | isMalicious
    web:ismalicious.com

    Akira Stealer sample 8c827ebe6affd13781eba8a6751e4ee90168fe8511faa1e7b26bd96fdb9f281f: listed by 2 threat sources ( malware , c2). File type, signatures, hashes, reports.

  • Akira Stealer malware sample f63453a6624e5565… | isMalicious
    web:ismalicious.com

    Akira Stealer sample f63453a6624e55650957b76802c76c24678821a145694e8dc86b61ab19681e0b: listed by 2 threat sources ( malware , c2). File type, signatures, hashes, reports.

  • ThreatFox | 03f15483f39c480ebdcfe20891d6601c3800267c
    web:threatfox.abuse.ch

    Akira Stealer IOC: 03f15483f39c480ebdcfe20891d6601c3800267c ( sha1_hash ) You are viewing the ThreatFox database entry for sha1_hash ...

  • ThreatFox | 3d3af402b61751416191308d5756872d3a7423ce
    web:threatfox.abuse.ch

    Akira Stealer IOC: 3d3af402b61751416191308d5756872d3a7423ce ( sha1_hash ) You are viewing the ThreatFox database entry for sha1_hash ...

  • Akira Stealer : An Undetected Python Based Info-stealer
    web:www.cyfirma.com

    Akira is an information stealing malware being offered on a dedicated website as MaaS ( malware - as -a-service) with the tag " Akira Undetector". The web platform provides an interface to generate a new stealer binary with instructions to use the malware , leveraging the Telegram channel to provide updates and command-and-control functionality.

  • Akira Stealer Malware: Live IOCs & Infrastructure - ThreatFusionAI™
    web:www.threatfusionai.com

    Akira Stealer : 9 new indicators in the last 7 days, 12 tracked. C2 servers, payload URLs, file hashes and where the infrastructure is hosted, updated continuously.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.