Classification: Malicious
sub_3c92bfc71004.bin is a malicious file sample. Linked to Akira malware. Reported by 5 threat sources, last seen 2026-08-26.
Detection summary
- 85 antivirus detections (71% detection ratio)
- 0 IDS alerts
- 19 processes observed
- 0 contacted hosts
- 0 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Generic Malware |
Cyber Threat Alliance |
2026-08-26 10:17:09 |
2026-08-26 10:17:09 |
malicious-activity
|
|
| Akira |
Triage |
2026-05-24 01:35:33 |
2026-05-24 01:35:33 |
malicious-activity
|
|
| Akira Ransomware |
Maltiverse Research Team |
2024-11-12 10:35:06 |
2024-11-12 10:35:06 |
|
|
| Akira ransomware variant |
Malware News |
2024-11-09 06:25:45 |
2024-11-09 06:25:45 |
|
S1129 Akira
|
| Generic Malware |
Hybrid-Analysis |
2023-05-20 15:45:03 |
2023-05-20 15:45:03 |
|
|
Tags
evasive
ransomware
windows-server-utility
ai-agent
akira
98f2ed3f-3238-4af6-a398-488c1e6d65b2
execution
persistence
ransowmware
spyware
stealer
Sample information
- Filenames
- sub_3c92bfc71004.bin, bounty-47708161276199055
- File type
- PE32+ executable (console) x86-64, for MS Windows
- Size
- 586240 bytes
- MD5
c7ae7f5becb7cf94aa107ddc1caf4b03- SHA-1
923161f345ed3566707f9f878cc311bc6a0c5268- SHA-256
3c92bfc71004340ebc00146ced294bc94f49f6a5e212016ac05e7d10fcb3312c- First indexed
- 2023-05-20 15:23:18
- Last updated
- 2026-05-24 02:00:07
Antivirus detections
| Engine | Detection |
|---|
| Lionic | Trojan.Win32.Gen.4!c |
| Elastic | malicious (high confidence) |
| DrWeb | Trojan.Encoder.37542 |
| MicroWorld-eScan | Trojan.Ransom.Akira.A |
| McAfee | RDN/Ransom |
| Malwarebytes | Malware.AI.4208797674 |
| Zillya | Trojan.Akira.Win32.1 |
| Sangfor | Ransom.Win64.Akira.Vd1j |
| K7AntiVirus | Trojan ( 005a430d1 ) |
| Alibaba | Ransom:Win32/Akira.60244cee |
| K7GW | Trojan ( 005a430d1 ) |
| Cybereason | malicious.345ed3 |
| Cyren | W64/ABRisk.VHNP-0879 |
| Symantec | Downloader |
| ESET-NOD32 | a variant of Win64/Filecoder.Akira.A |
| APEX | Malicious |
| Paloalto | generic.ml |
| Kaspersky | Trojan-Ransom.Win64.Akira.a |
| BitDefender | Trojan.Ransom.Akira.A |
| NANO-Antivirus | Trojan.Win64.Ransom.jwbbaj |
| Avast | Win64:RansomX-gen [Ransom] |
| Tencent | Malware.Win32.Gencirc.10be9ba0 |
| Emsisoft | Trojan.Ransom.Akira.A (B) |
| F-Secure | Trojan.TR/AD.Nekark.lpmte |
| VIPRE | Trojan.Ransom.Akira.A |
| TrendMicro | Ransom.Win64.AKIRA.THDBFBC |
| McAfee-GW-Edition | RDN/Ransom |
| FireEye | Generic.mg.c7ae7f5becb7cf94 |
| Sophos | Troj/Akira-A |
| GData | Trojan.Ransom.Akira.A |
| Webroot | W32.Ransom.Akira |
| Avira | TR/AD.Nekark.lpmte |
| Antiy-AVL | Trojan/Win32.Wacatac |
| Arcabit | Trojan.Ransom.Akira.A |
| ViRobot | Trojan.Win.Z.Akira.586240 |
| ZoneAlarm | Trojan-Ransom.Win64.Akira.a |
| Microsoft | Ransom:Win64/Akira!MTB |
| Cynet | Malicious (score: 99) |
| AhnLab-V3 | Ransomware/Win.Akira.C5412191 |
| ALYac | Trojan.Ransom.Akira.A |
| MAX | malware (ai score=82) |
| Cylance | unsafe |
| Panda | Trj/Chgt.AD |
| TrendMicro-HouseCall | Ransom.Win64.AKIRA.THDBFBC |
| Rising | Ransom.Gen!8.DE83 (TFE:5:0nMqEPFFp1) |
| MaxSecure | Trojan.Malware.207043574.susgen |
| Fortinet | W64/Filecoder.HZ!tr.ransom |
| AVG | Win64:RansomX-gen [Ransom] |
| DeepInstinct | MALICIOUS |
| CrowdStrike | win/malicious_confidence_100% (W) |
| ALYac | Trojan.Ransom.Filecoder |
| AhnLab-V3 | Ransomware/Win.Akira.R587425 |
| Alibaba | Ransom:Win64/Akira.2315162c |
| Avira | HEUR/AGEN.1375071 |
| Bkav | W64.AIDetectMalware |
| CAT-QuickHeal | Ransom.Akira.S30118229 |
| CTX | exe.ransomware.akira |
| ClamAV | Multios.Ransomware.Megazord-10021030-1 |
| Cylance | Unsafe |
| DrWeb | Trojan.Encoder.37580 |
| F-Secure | Trojan:W32/Akira.A |
| Fortinet | W64/Akira.A!tr.ransom |
| GData | Win64.Trojan-Ransom.Akiranso.A |
| Google | Detected |
| Gridinsoft | Ransom.Win64.Wacatac.oa!s1 |
| Ikarus | Trojan-Ransom.Akira |
| Jiangmin | Trojan.Akira.a |
| K7AntiVirus | Trojan ( 005a55941 ) |
| K7GW | Trojan ( 005a55941 ) |
| Kingsoft | Win32.Troj.Unknown.a |
| Lionic | Trojan.Win32.Akira.4!c |
| Malwarebytes | Ransom.Akira |
| MaxSecure | Trojan.Malware.215904336.susgen |
| McAfeeD | ti!3C92BFC71004 |
| Rising | Ransom.Akira!1.E5DB (CLASSIC) |
| Sangfor | Ransom.Win64.Akira.Vkid |
| SentinelOne | Static AI - Suspicious PE |
| Skyhigh | RDN/Ransom |
| Varist | W64/Akira.A.gen!Eldorado |
| ViRobot | Trojan.Win.S.Ransom.586240 |
| VirIT | Trojan.Win32.GenusT.DYBU |
| Xcitium | Malware@#qv7s1lo511w3 |
| Yandex | Trojan.Filecoder!B13yLyfwx6s |
| alibabacloud | Ransomware:Win/Akira.A |
| huorong | Ransom/LockFile.kp |
Process list
| Name | Command line |
|---|
| bounty-47708161276199055.exe | |
| smss.exe | \SystemRoot\System32\smss.exe |
| wininit.exe | |
| services.exe | |
| svchost.exe | -k networkservice -p -s CryptSvc |
| vssvc.exe | |
| svchost.exe | -k swprv |
| svchost.exe | -k WerSvcGroup |
| lsass.exe | |
| svchost.exe | -k DcomLaunch -p |
| DllHost.exe | /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} |
| WerFault.exe | -u -p 6716 -s 320 |
| DllHost.exe | /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} |
| DllHost.exe | /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} |
| DllHost.exe | /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} |
| DllHost.exe | /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} |
| svchost.exe | -k rpcss -p |
| svchost.exe | -k LocalServiceNoNetwork -p |
| powershell.exe | -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject" |