2c7aeac07ce7f03b74952e0e243bd52f2bfa60fadc92dd71a6a1fee2d14cdd77
Classification: Malicious
2c7aeac07ce7f03b74952e0e243bd52f2bfa60fadc92dd71a6a1fee2d14cdd77 is a malicious file sample. Linked to Akira malware. Detected by 99 antivirus engines.
Detection summary
- 99 antivirus detections
- 0 IDS alerts
- 2 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: AKIRA (S1129)
Intrusion sets: AKIRA (G1024)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Generic Malware | Hybrid-Analysis | 2024-09-02 22:15:04 | 2026-08-19 09:45:06 | malicious-activity | |
| Akira Ransomware | Maltiverse Research Team | 2024-11-12 10:31:44 | 2024-11-12 10:31:44 | ||
| Akira Ransomware | Cisco Talos | 2024-09-01 12:00:00 | 2024-11-12 10:03:14 | S1129 Akira G1024 Akira S1129 Akira G1024 Akira | |
| Akira ransomware | Cisco Talos | 2024-11-11 12:53:25 | 2024-11-11 12:53:25 | T1486 Data Encrypted for Impact | |
| Akira Ransomware | Cisco Talos Research | 2024-11-11 12:50:31 | 2024-11-11 12:50:31 | S1129 Akira | |
| Akira | ThreatFox Abuse.ch | 2024-11-09 08:24:59 | 2024-11-11 08:19:07 | S1129 Akira G1024 Akira | |
| Akira ransomware variant | Malware News | 2024-11-09 06:24:46 | 2024-11-09 06:24:46 | S1129 Akira |
Tags
evasive windows-server-utility ai-agent akira ransomware win.akira akira-ransomware 98f2ed3f-3238-4af6-a398-488c1e6d65b2Sample information
- Filenames
- 2c7aeac07ce7f03b74952e0e243bd52f2bfa60fadc92dd71a6a1fee2d14cdd77, bounty-59702250782539079
- File type
- PE32 executable (GUI) Intel 80386, for MS Windows
- Size
- 900096 bytes
- MD5
2a7a76cde7e970c06316e3ae4feadbe3- SHA-1
89d195f59bba9c3b43635607f9f1c3051645332c- SHA-256
2c7aeac07ce7f03b74952e0e243bd52f2bfa60fadc92dd71a6a1fee2d14cdd77- First indexed
- 2024-09-02 21:55:14
- Last updated
- 2026-08-19 09:45:06
Antivirus detections
| Engine | Detection |
|---|---|
| ALYac | Trojan.Ransom.Filecoder |
| APEX | Malicious |
| AVG | Win32:MalwareX-gen [Trj] |
| AhnLab-V3 | Ransomware/Win.Akira.C5666088 |
| Alibaba | Ransom:Win32/Akira.b9562b88 |
| Antiy-AVL | Trojan[Ransom]/Win64.Akira |
| Arcabit | Trojan.Ransom.Akira.12 |
| Avast | Win32:MalwareX-gen [Trj] |
| Avira | TR/AD.Nekark.mflks |
| BitDefender | Gen:Variant.Ransom.Akira.12 |
| Bkav | W32.AIDetectMalware |
| CTX | exe.ransomware.akira |
| ClamAV | Multios.Ransomware.Megazord-10021030-1 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| Cynet | Malicious (score: 99) |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.Encoder.40933 |
| ESET-NOD32 | a variant of Win32/Filecoder.OKE |
| Elastic | Windows.Ransomware.Akira |
| Emsisoft | Gen:Variant.Ransom.Akira.12 (B) |
| F-Secure | Trojan.TR/AD.Nekark.mflks |
| FireEye | Gen:Variant.Ransom.Akira.12 |
| Fortinet | W32/Filecoder.OKE!tr |
| GData | Gen:Variant.Ransom.Akira.12 |
| Detected | |
| Ikarus | Trojan-Ransom.Akira |
| Jiangmin | Trojan.Akira.l |
| K7AntiVirus | Trojan ( 0058fc5a1 ) |
| K7GW | Trojan ( 0058fc5a1 ) |
| Kaspersky | HEUR:Trojan-Ransom.Win64.Akira.b |
| Kingsoft | Win64.Trojan-Ransom.Akira.b |
| Lionic | Trojan.Win32.Akira.j!c |
| Malwarebytes | Malware.AI.1655178584 |
| MaxSecure | Trojan.Malware.121218.susgen |
| McAfee | Ransom-Akira!2A7A76CDE7E9 |
| McAfeeD | Real Protect-LS!2A7A76CDE7E9 |
| MicroWorld-eScan | Gen:Variant.Ransom.Akira.12 |
| Microsoft | Ransom:Win32/Akira.A!ibt |
| Paloalto | generic.ml |
| Panda | Trj/GdSda.A |
| Rising | Ransom.Agent!8.6B7 (CLOUD) |
| Sangfor | Ransom.Win32.Akira.Vnlu |
| Skyhigh | BehavesLike.Win32.Generic.ch |
| Sophos | Mal/Generic-S |
| Symantec | Trojan Horse |
| Tencent | Malware.Win32.Gencirc.10c038e5 |
| Trapmine | suspicious.low.ml.score |
| TrendMicro | Ransom.Win32.AKIRA.YXEH2Z |
| TrendMicro-HouseCall | Ransom.Win32.AKIRA.YXEH2Z |
| VBA32 | TrojanRansom.Win64.Akira |
| VIPRE | Gen:Variant.Ransom.Akira.12 |
| Varist | W32/Filecoder.QZZV-0658 |
| VirIT | Trojan.Win32.Genus.WJY |
| Webroot | W32.Trojan.Win64.Akira |
| Xcitium | Malware@#vm67dl8egilb |
| Zillya | Trojan.Filecoder.Win32.36375 |
| ZoneAlarm | HEUR:Trojan-Ransom.Win64.Akira.b |
| alibabacloud | Ransomware:Win/Akira.A9Rep |
| huorong | Ransom/Akira.c |
| CAT-QuickHeal | Ransom.Win32CiR |
| Sangfor | Ransom.Win32.Akira.Vgyy |
| Yandex | Trojan.Filecoder!RFAJqN/vvro |
| Sangfor | Ransom.Win32.Akira.Vume |
| Arcabit | Trojan.Generic.D4746356 |
| BitDefender | Trojan.GenericKD.74736470 |
| Emsisoft | Trojan.GenericKD.74736470 (B) |
| FireEye | Trojan.GenericKD.74736470 |
| GData | Trojan.GenericKD.74736470 |
| Kingsoft | malware.kb.a.863 |
| MicroWorld-eScan | Trojan.GenericKD.74736470 |
| VIPRE | Trojan.GenericKD.74736470 |
| ViRobot | Trojan.Win.Z.Akira.900096 |
| Bkav | W32.Common.5331569A |
| CAT-QuickHeal | Trojan.Ghanarava.1729774800eadbe3 |
| CTX | exe.trojan.akira |
| Elastic | Multi.Ransomware.Akira |
| Sangfor | Ransom.Win32.Akira.Vwth |
| AVG | Win32:MalwareX-gen [Misc] |
| Arcabit | Trojan.Ransom.Akira.49 |
| Avast | Win32:MalwareX-gen [Misc] |
| Avira | TR/W32.Agent |
| BitDefender | Gen:Variant.Ransom.Akira.49 |
| ESET-NOD32 | Win32/Filecoder.Akira.A trojan |
| Emsisoft | Gen:Variant.Ransom.Akira.49 (B) |
| F-Secure | Trojan.TR/W32.Agent |
| GData | Gen:Variant.Ransom.Akira.49 |
| Malwarebytes | Ransom.Akira |
| MicroWorld-eScan | Gen:Variant.Ransom.Akira.49 |
| NANO-Antivirus | Trojan.Win32.Ransom.krvddi |
| Rising | Ransom.Akira!8.ECD1 (TFE:5:kCv0wlBB8qU) |
| Sangfor | Ransom.Win32.Akira.V9of |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | Ransom-Akira!2A7A76CDE7E9 |
| TrellixENS | Ransom-Akira!2A7A76CDE7E9 |
| TrendMicro-HouseCall | Ransom.Win32.AKIRA.SMYXEH2Z |
| VIPRE | Gen:Variant.Ransom.Akira.49 |
| Webroot | W32.Trojan.Gen |
| huorong | Ransom/Akira.f |
Process list
| Name | Command line |
|---|---|
| bounty-59702250782539079.exe | |
| powershell.exe | -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject" |