TF-1988794
high
📛 Threat Title
Akira Stealer: SHA256 hash of a malware sample (payload) ccd8c73dc516f01fc03978265e62025415550ad423d7cfe8fbc16f4417467c39
Description
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Akira Stealer. Confidence: 95. First seen: 2026-10-25 17:41:27 UTC. Reporter: Grim.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
ccd8c73dc516f01fc03978265e62025415550ad423d7cfe8fbc16f4417467c39
VT 29 / 75
IOC database
- Type
- hash_sha256
- Value
ccd8c73dc516f01fc03978265e62025415550ad423d7cfe8fbc16f4417467c39- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- SHA256 hash of a malware sample (payload) attributed to Akira Stealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 29 of 75 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| alibabacloud | malicious | Trojan[stealer]:Multi/Wacatac.B9nj |
| Avast | malicious | Win64:Evo-gen [Trj] |
| AVG | malicious | Win64:Evo-gen [Trj] |
| Avira | malicious | TR/W64.Evo |
| Bkav | malicious | W32.Malware.2243D707 |
| CrowdStrike | malicious | win/malicious_confidence_60% (W) |
| Cynet | malicious | Malicious (score: 99) |
| DeepInstinct | malicious | MALICIOUS |
| Elastic | malicious | malicious (high confidence) |
| ESET-NOD32 | malicious | WinGo/GenKryptik.HVTH trojan |
| F-Secure | malicious | Trojan.TR/W64.Evo |
| Fortinet | malicious | W64/Vidar.YI!tr |
| malicious | Detected |
|
| Ikarus | malicious | Trojan-Spy.Win64.Agent |
| Kaspersky | malicious | UDS:Trojan-PSW.Win64.BroPass |
| Kingsoft | malicious | Win32.Trojan-PSW.Agent.gen |
| Lionic | malicious | Trojan.Win32.Agent.Y!c |
| Malwarebytes | malicious | Malware.AI.2957342724 |
| MaxSecure | malicious | Trojan.Malware.121218.susgen |
| McAfeeD | malicious | ti!CCD8C73DC516 |
| Microsoft | malicious | Trojan:Win32/Wacatac.B!ml |
| Paloalto | malicious | generic.ml |
| Panda | malicious | Trj/PhxBzA.A |
| Sangfor | malicious | Trojan.Win32.Evo.Vutu |
| Sophos | malicious | Mal/Generic-S |
| Symantec | malicious | ML.Attribute.HighConfidence |
| Tencent | malicious | Win32.Trojan.FalseSign.Lcnw |
| TrellixENS | malicious | Artemis!29F0A08ECF6D |
| Varist | malicious | W64/WinGo.J.gen!Eldorado |
Details From VirusTotal
Basic Properties
| MD5 | 29f0a08ecf6d5d857bc42ab0c55c3ad8 |
| SHA-1 | 255bce3c36ae07ca09fe08865dce6f04cd460f14 |
| SHA-256 | ccd8c73dc516f01fc03978265e62025415550ad423d7cfe8fbc16f4417467c39 |
| VHash | 056086651d15551d15545az2e!z |
| SSDEEP | 49152:jcbj32Zp9c5s0RDfiQ8p78001PxN7lqRQdh8qeCmt2PdSJJbWLeLVKFiDG4ZAWht:jpO5s0YqtItIc5 |
| TLSH | T146462807BB9455E8C096EA38C4BA4653B7607C8CC33277E72E51AB742F757D0AA39B04 |
| File type | Win32 EXE |
| File type tag | peexe |
| File extension | exe |
| Magic | PE32+ executable (GUI) x86-64, for MS Windows |
| File size | 5.4 MB |
History
| First seen on VirusTotal | 2026-10-25 14:58 UTC |
| Last submission | 2026-10-25 16:00 UTC |
| Last analysis | 2026-10-25 18:03 UTC |
| Last modified on VirusTotal | 2026-10-25 20:12 UTC |
Known Names
rh7d1gr9.exeglaicer.exe
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Akira Stealer. Confidence: 95. First seen: 2026-10-25 17:41:27 UTC. Reporter: Grim.
Remediations (10)
-
web:bazaar.abuse.ch
A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as Akira .
-
web:bazaar.abuse.ch
Malware samples associated with tag akira MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with akira . Database Entry
-
web:github.com
Akira A malware strain primarily designed for stealing cryptocurrency wallets and credentials from infected devices.
-
web:imalware.com
It compares a file's fingerprint (its MD5, SHA-1 or SHA-256 hash ) with a list of fingerprints of known malware . If the hash matches, the file is identical to a known malicious sample .
-
web:ismalicious.com
Akira Stealer sample 8c827ebe6affd13781eba8a6751e4ee90168fe8511faa1e7b26bd96fdb9f281f: listed by 2 threat sources ( malware , c2). File type, signatures, hashes, reports.
-
web:ismalicious.com
Akira Stealer sample f63453a6624e55650957b76802c76c24678821a145694e8dc86b61ab19681e0b: listed by 2 threat sources ( malware , c2). File type, signatures, hashes, reports.
-
web:threatfox.abuse.ch
Akira Stealer IOC: 8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce ( sha256_hash ) You are viewing the ThreatFox database entry for sha256_hash ...
-
web:threatfox.abuse.ch
Akira Stealer IOC: 8c827ebe6affd13781eba8a6751e4ee90168fe8511faa1e7b26bd96fdb9f281f ( sha256_hash ) You are viewing the ThreatFox database entry for sha256_hash ...
-
web:www.cyfirma.com
Akira is an information stealing malware being offered on a dedicated website as MaaS ( malware - as -a-service) with the tag " Akira Undetector". The web platform provides an interface to generate a new stealer binary with instructions to use the malware , leveraging the Telegram channel to provide updates and command-and-control functionality.
-
web:www.glueckkanja.com
The stealer script was invoked directly from disk, but all staging and execution logic remained embedded within the Electron bundle. In summary, main.exe served as the obfuscated, multi-layered execution core — acting as the gatekeeper between initial persistence and the full activation of the Akira Stealer payload in astor.py.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.