TF-1964475
high
📛 Threat Title
Akira Stealer: SHA1 hash of a malware sample (payload) 21ef070e39f651118a804882374dc2dfa3e38666
Description
Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Akira Stealer. Confidence: 95. First seen: 2026-10-13 22:41:06 UTC. Reporter: Grim.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha1
21ef070e39f651118a804882374dc2dfa3e38666
IOC database
- Type
- hash_sha1
- Value
21ef070e39f651118a804882374dc2dfa3e38666- First seen
- Last seen
- Attached to this threat
- Appears in
- 3 threats
- Description
- SHA1 hash of a malware sample (payload) attributed to Akira Stealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Akira Stealer. Confidence: 95. First seen: 2026-10-13 22:41:06 UTC. Reporter: Grim.
Remediations (10)
-
web:bazaar.abuse.ch
Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1 ), imphash, tlsh hash , ClamAV signature, tag or malware family. Browse Database
-
web:bazaar.abuse.ch
A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as Akira .
-
web:bazaar.abuse.ch
Malware samples associated with tag akira MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with akira . Database Entry
-
web:boteraser.com
⚠️ Overview Akira Stealer is a commodity information-stealing malware first detected in the wild in early 2023, likely developed and operated by a Russian-speaking threat actor tracked as " Akira Team" or " Akira Stealer Group," and is categorized as a credentials stealer and infostealer within the broader malware - as -a-service ecosystem, according to reports from Zscaler ThreatLabz (March ...
-
web:cipherssecurity.com
Check MD5, SHA-1 , or SHA-256 file hashes against MalwareBazaar and VirusTotal feeds. Drop a file — hashing happens in your browser, never uploaded.
-
web:ismalicious.com
Akira sample 2084ab8f92a86a37a35879378610949e21ea7b5030313655bb82fe6c67772b0d: listed by 2 threat sources ( malware , apt, c2). File type, signatures, hashes, reports.
-
web:threatfox.abuse.ch
Akira Stealer IOC: 03f15483f39c480ebdcfe20891d6601c3800267c ( sha1_hash ) You are viewing the ThreatFox database entry for sha1_hash ...
-
web:threatfox.abuse.ch
Akira Stealer IOC: 3d3af402b61751416191308d5756872d3a7423ce ( sha1_hash ) You are viewing the ThreatFox database entry for sha1_hash ...
-
web:www.cyfirma.com
Akira is an information stealing malware being offered on a dedicated website as MaaS ( malware - as -a-service) with the tag " Akira Undetector". The web platform provides an interface to generate a new stealer binary with instructions to use the malware , leveraging the Telegram channel to provide updates and command-and-control functionality.
-
web:www.glueckkanja.com
The stealer script was invoked directly from disk, but all staging and execution logic remained embedded within the Electron bundle. In summary, main.exe served as the obfuscated, multi-layered execution core — acting as the gatekeeper between initial persistence and the full activation of the Akira Stealer payload in astor.py.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.