MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df282796c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Akira


Vendor detections: 11


Intelligence 11 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df282796c
SHA3-384 hash: f1f3edcb4254a5a32de5313625d2acdfc6dbff3c946cf20d92efdac2177f2d5b687759d6643ee6e1a8a5341635d5ba7b
SHA1 hash: 94ed0a9c9c9fe568dc814218edeb17b951fc78a8
MD5 hash: 7d827558e7841cc2887fc99537c1c97e
humanhash: kilo-blossom-violet-juliet
File name:0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df282796c
Download: download sample
Signature Akira
Create hunting rule
File size:4'625'664 bytes
First seen:2025-06-11 08:06:07 UTC
Last seen:Never
File type: elf
MIME type:application/x-sharedlib
ssdeep 49152:uPiMz0OtgsNlmtAf7/oMrIt+fAljaCi24rGcPjSE4AKRk0A+fKGqlq+k75joWoMC:uPiMz0q1SSqbpep
TLSH T1F0268C13FCB40A34FAEBCF78845D9A281B32794CC345DBA31A2983615253365EF4F699
telfhash t12b0176098e3c1ac9e8f33c21cc606ba2c48bd92d56949b18ff12cdca5d6e909f610c1f
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika elf
Reporter TheRavenFile
Tags:akira elf Ransomware


Avatar
RakeshKrish12
Source: https://github.com/TheRavenFile/Daily-Hunt/blob/main/Akira%20Ransomware

Intelligence

File Origin
# of uploads :
1
# of downloads :
202
Origin country :
IN IN
Vendor Threat Intelligence
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=684939008bd5d68a12e7a760linux22vpnfull_triage
Tags:
malware
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
x86
Packer:
not packed
Botnet:
unknown
Number of open files:
13
Number of processes launched:
1
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df282796c
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Malware family:
Akira Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9300734a-b70c-4524-adad-f44c32697bac
Result
Threat name:
Akira
Create hunting rule
Detection:
malicious
Classification:
rans.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1711996
Signature
Found Tor onion address
Multi AV Scanner detection for submitted file
Yara detected Akira Ransomware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1711996 Sample: EL3QTe0Hab.elf Startdate: 11/06/2025 Architecture: LINUX Score: 60 12 54.247.62.1, 443, 52472 AMAZON-02US United States 2->12 14 Multi AV Scanner detection for submitted file 2->14 16 Yara detected Akira Ransomware 2->16 18 Found Tor onion address 2->18 6 dash rm 2->6         started        8 dash rm 2->8         started        10 EL3QTe0Hab.elf 2->10         started        signatures3 process4
Score:
65%
Verdict:
Susipicious
File Type:
ELF
Link:
https://malprob.io/report/0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df282796c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df282796c/
Threat name:
Linux.Ransomware.Akira
Create hunting rule
Status:
Malicious
First seen:
2024-03-16 13:09:44 UTC
File Type:
ELF64 Little (SO)
AV detection:
22 of 36 (61.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b3q5fbhnmyyhhbzacld33z72yxfbcikah4nf2lkuceyx34ucpfwa._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/250611-jzka8aymx8/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Verdict:
Malicious
Tags:
Multios.Ransomware.Megazord-10021030-1 ransomware
YARA:
esxi_commands_ransomware
Link:
https://app.threat.zone/submission/df1859d4-d195-4b1f-aaa0-5b29fa6ea456
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Osint
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df282796c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:esxi_commands_ransomware
Create hunting rule
Author:Marius 'f0wL' Genheimer <hello@dissectingmalwa.re>
Description:Detects commands issued by Ransomware to interact with ESXi VMs
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:Linux_Ransomware_Akira_27440619
Create hunting rule
Author:Elastic Security
Rule name:Multi_Ransomware_Akira_21842eb3
Create hunting rule
Author:Elastic Security
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Reviews
IDCapabilitiesEvidence
FFI_METHODSCan perform system-level operations via FFIstd::ffi::os_str::OsStr::to_str::hd3b7b9f4dcfe61fc
FILE_IO_WRITECan Create and Remove Filesstd::fs::remove_file::hf5ecab64191d4727
std::fs::write::inner::hea7705dbae08c30a
std::fs::OpenOptions::open::h1cfdd72227041f25
std::fs::OpenOptions::_open::hbb3d8ecb99af4a9a

Comments