2026-07-08_e99852a25fd5ef2bb4a76246f2d8b376_akira

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_e99852a25fd5ef2bb4a76246f2d8b376_akira
Size 4.0MB
Sample260708-h62cmscv4z
SHA256 85a12bd54d4987a76ecb4ce06f0cef1979e18f50e70730954d2ade9355dec2ce
MD5 e99852a25fd5ef2bb4a76246f2d8b376
SHA1 533cbe45bdd1ad46c0dbaee84351db3219ddbe14
SHA512 524b73af5793249a0f6bca6231baaf7d4d14d45a1de26434ec366c73717550233c7ba9182b7a043465ebba1ba0afab6af56abd15a266bf0a27b47caafe216b5c
SSDEEP 12288:QqxUE00X3QMgXkqFqVj0WypaPRKtAEh+C10SaO/ekKYgt1EW7++d3d5xBUJfl:TUE00OXR4ipIKtcC15WkBgfEW735U/
TLSH
T19016303AAC56EA35D6153379F783F9B7FEC1E28B11A94379628DCF4AED16080DC90601
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-08_e99852a25fd5ef2bb4a76246f2d8b376_akira

File Explorer

2026-07-08_e99852a25fd5ef2bb4a76246f2d8b376_akira

.exe 4.0MB

2026-07-08_e99852a25fd5ef2bb4a76246f2d8b376_akira

IMPHASH 38de4769a70882943f3982c1757a8c8b
SHA256 85a12bd54d4987a76ecb4ce06f0cef1979e18f50e70730954d2ade9355dec2ce
MD5 e99852a25fd5ef2bb4a76246f2d8b376
SHA1 533cbe45bdd1ad46c0dbaee84351db3219ddbe14
SHA512 524b73af5793249a0f6bca6231baaf7d4d14d45a1de26434ec366c73717550233c7ba9182b7a043465ebba1ba0afab6af56abd15a266bf0a27b47caafe216b5c
SSDEEP 12288:QqxUE00X3QMgXkqFqVj0WypaPRKtAEh+C10SaO/ekKYgt1EW7++d3d5xBUJfl:TUE00OXR4ipIKtcC15WkBgfEW735U/
TLSH
T19016303AAC56EA35D6153379F783F9B7FEC1E28B11A94379628DCF4AED16080DC90601
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

0a:49:75:8b:84:1f:9a:fb:5c:af:5e:c0:11:2b:2c:ce:aa:2f:f9:a5:78:8c:d5:d1:22:1e:f9:88:b1:7f:3f:80

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Morgan Collins,OU=IT,O=Titan Cloud Services,1.2.840.113549.1.9.1=#0c1a6d6f7267616e2e636f6c6c696e73406f75746c6f6f6b2e636f6d

Chains

Jul 7, 2026

CN=Morgan Collins,OU=IT,O=Titan Cloud Services,1.2.840.113549.1.9.1=#0c1a6d6f7267616e2e636f6c6c696e73406f75746c6f6f6b2e636f6d

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

api-ms-win-core-synch-l1-2-0

ord3 ord1 ord2

kernel32

ord20 ord151 ord216 ord223 ord263 ord272 ord277 ord295 ord311 ord325 ord333 ord380 ord403 ord409 ord426 ord454 ord458 ord503 ord540 ord544 ord561 ord568 ord572 ord573 ord605 ord621 ord622 ord640 ord648 ord669 GetModuleHandleA GetModuleHandleW ord730 ord737 ord768 ord785 ord792 ord806 ord833 ord889 ord895 ord899 ord911 ord912 ord918 ord1012 LoadLibraryA LoadLibraryW ord1047 ord1052 ord1054 ord1064 ord1161 ord1162 ord1184 ord1256 ord1264 ord1270 ord1271 ord1352 ord1358 ord1370 ord1421 ord1433 ord1442 ord1449 ord1460 ord1483 ord1484 ord1485 ord1487 ord1503 ord1533 ord1535 ord1544 ord1607 ord1625

api-ms-win-crt-environment-l1-1-0

ord0

api-ms-win-crt-heap-l1-1-0

ord22 ord23 ord24 ord25

api-ms-win-crt-locale-l1-1-0

ord8

api-ms-win-crt-math-l1-1-0

ord9

api-ms-win-crt-private-l1-1-0

ord1084 ord1085 ord1086

api-ms-win-crt-runtime-l1-1-0

ord0 ord6 ord7 ord23 ord25 ord31 ord36 ord38 ord51 ord54 ord55 ord71 ord84 ord85 ord99

api-ms-win-crt-stdio-l1-1-0

ord0 ord1 ord2 ord3 ord107 ord138

api-ms-win-crt-string-l1-1-0

ord121 ord129 ord132

ntdll

ord707 ord1345

Name

.text

Size

746KB

Virtual Size

746KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

199KB

Virtual Size

198KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.text01

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_e99852a25fd5ef2bb4a76246f2d8b376_akira

PE Signature issue

api-ms-win-core-synch-l1-2-0

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

generic