{ "id": "16085407-41ac-4674-a7f1-03211b9b8721", "created_at": "2026-04-06T00:21:30.386604Z", "updated_at": "2026-04-10T13:12:19.740154Z", "deleted_at": null, "sha1_hash": "83ad2b221a3a802e03885442870d93e6784d6f96", "title": "Decrypted: Akira ransomware", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 2858917, "plain_text": "Decrypted: Akira ransomware\r\nBy Threat Research TeamThreat Research Team\r\nArchived: 2026-04-05 23:19:20 UTC\r\nResearchers for Avast have developed a decryptor for the Akira ransomware and released it for public download.\r\nThe Akira ransomware appeared in March 2023 and since then, the gang claims successful attacks on various\r\norganizations in the education, finance and real estate industries, amongst others.\r\nSkip to how to use the Akira Ransomware Decryptor\r\nNote that this ransomware is not related to the Akira ransomware discovered by Karsten Hahn in 2017 and our\r\ndecryptor cannot be used to decrypt files from this old variant.\r\nThe Akira ransomware comes as a 64-bit Windows binary written for Windows operating system. It is written in\r\nC++ with heavy support from C++ libraries. Additionally, Boost library was used to implement the asynchronous\r\nencryption code. The binary is linked by Microsoft Linker version 14.35. \r\nIn June 2023, a security researcher rivitna published a sample that is compiled for Linux. The Linux version is 64-\r\nbit and uses the Boost library. \r\nAkira Encryption Schema \r\nDuring the run, the ransomware generates a symmetric encryption key using CryptGenRandom(), which is the\r\nrandom number generator implemented by Windows CryptoAPI. Files are encrypted by Chacha 2008 (D. J.\r\nBernstein’s implementation).  \r\nThe symmetric key is encrypted by the RSA-4096 cipher and appended to the end of the encrypted file. Public key\r\nis hardcoded in the ransomware binary and differs per sample. \r\nExclusion List \r\nWhen searching files for encryption, Akira is not especially fussy. Whilst ransomware strains usually have a list of\r\nfile types to encrypt, Akira has a list of files not to encrypt: \r\n.exe\r\n.dll\r\n.lnk\r\n.sys\r\n.msi\r\nakira_readme.txt\r\nFurthermore, there are folders that are always ignored by Akira: \r\nhttps://decoded.avast.io/threatresearch/decrypted-akira-ransomware/\r\nPage 1 of 8\n\nwinnt\r\ntemp\r\nthumb\r\n$Recycle.Bin\r\n$RECYCLE.BIN\r\nSystem Volume Information\r\nBoot\r\nWindows\r\nTrend Micro\r\nThere is even the legacy winnt folder, which was used as default folder for installation of Windows 2000. \r\nEncryption Schema for Small Files \r\nFiles are encrypted depending on their size. For files of 2,000,000 bytes and smaller, the ransomware encrypts the\r\nfirst half of the file. The structure of such an encrypted file is as follows: \r\nEncryption Schema for Large Files\r\nFor files sizes greater than 2,000,000 bytes, Akira encrypts four blocks. First, the size of a full block is calculated\r\n(see Figure 1).\r\nFigure 1: Akira’s calculation of full encryption block size.\r\nThe size of the encrypted part of the block is then calculated (see Figure 2).\r\nFigure 2: Akira’s calculation of the size of encryption portion of block.\r\nThe layout of an encrypted file is then created (see Figure 3).\r\nhttps://decoded.avast.io/threatresearch/decrypted-akira-ransomware/\r\nPage 2 of 8\n\nFigure 3: Layout of encrypted file.\r\nThe structure of the file footer can be described by the following structure in C language:\r\nFigure 4: File footer structure.\r\nEncrypted files can be recognized by the extension .akira . A file named akira_readme.txt – the ransom note\r\n– is dropped in each folder (see Figure 5).\r\nFigure 5: Akira ransom note file.\r\nThe ransom note mentions two TOR sites. In the first one (Figure 6), the user can list the hacked companies; in the\r\nsecond, victims are instructed on how to make payment (Figure 7).\r\nhttps://decoded.avast.io/threatresearch/decrypted-akira-ransomware/\r\nPage 3 of 8\n\nFigure 6: TOR site listing and describing victim company.\r\nFigure 7: Akira TOR site instructing victim on how to pay ransom.\r\nLinux Version of Akira\r\nThe Linux version of the Akira ransomware works identically like its Windows counterpart. Encrypted files have\r\nthe same extension and the same encryption schema. Obviously, Windows CryptoAPI is not available on Linux,\r\nso the ransomware authors used Crypto++ library to cover the parts that are handled by CryptoAPI in Windows.\r\nOur team is currently developing a Linux version of our decryptors. In the meantime, the Windows version of the\r\ndecryptor can be used to decrypt files encrypted by the Linux version of the ransomware. Please use WINE layer\r\nto run the decryptor under Linux.\r\nSimilarities to Conti\r\nAkira has a few similarities to the Conti v2 ransomware, which may indicate that the malware authors were at\r\nleast inspired by the leaked Conti sources. Commonalities include:\r\n1. List of file type exclusions. Akira ignores files with the same extensions as Conti, except that there’s\r\nakira_readme.txt instead of R3ADM3.txt .\r\nhttps://decoded.avast.io/threatresearch/decrypted-akira-ransomware/\r\nPage 4 of 8\n\n2. List of directory exclusions. Again, Akira ignores the same folders as Conti, including winnt and Trend\r\nMicro , which makes Trend Micro’s default installation folder especially resilient against both ransomware\r\nstrains.\r\n3. The structure of the Akira file tail is equal to the file tail appended by Conti (see Figure 8)\r\nFigure 8: Conti ransomware file tail.\r\nThe member variable bEncryptType is set to 0x24, 0x25, 0x26 by Conti version 2, Akira uses 0x32.\r\n4. The implementation of ChaCha 2008 used by Akira ransomware is the same as the one used by Conti\r\nransomware.\r\n5. The code for key generation (two calls to CryptGenRandom followed by CryptEncrypt) resembles Conti’s\r\nkey generation function.\r\nHow to use the Avast decryption tool to decrypt files encrypted by the ransomware\r\nPlease, read the instructions carefully. The decryption success rate will depend on it. If you don’t like reading\r\nmanuals, at least read the instructions about the file pair.\r\n1. The first step is to download the decryptor binary. Avast provides a 64-bit decryptor, as the ransomware is also a\r\n64-bit and can’t run on 32-bit Windows. If you have no choice but to use 32-bit applications, you may download\r\n32-bit decryptor here.\r\n2. Run the executable file, preferably as an administrator. It starts as a wizard, leading you through the\r\nconfiguration of the decryption process.\r\n3. On the initial page, we have a link to the license information. Click the Next button when you are ready to start.\r\nhttps://decoded.avast.io/threatresearch/decrypted-akira-ransomware/\r\nPage 5 of 8\n\n4. On the next page, select the list of locations you want to be searched for and decrypted. By default, it has a list\r\nof all local drives:\r\n5. On the following page, you need to supply an example of a file in its original form and then one encrypted by\r\nAkira ransomware. Type both names of the files. You can also drag \u0026 drop files from Windows Explorer to the\r\nwizard page.\r\nIt is extremely important to pick a pair of files that are as big as you can find. Due to Akira’s block size\r\ncalculation, there may be dramatic difference on the size limit even for files that differ by a size of 1 byte.\r\nWhen you click Next, the decryption tool will carefully examine the file pair and tells you what the biggest\r\ndecryptable file is. In general, the size limit should be the same as the size of the original file:\r\n6. The next page is where the password cracking process takes place. Click Start when you are ready to begin.\r\nThis process usually only takes a few seconds but will require a large amount of system memory. This is why we\r\nstrongly recommend using the 64-bit version of the decryption tool.\r\nOnce the password is found, you can continue to decrypt all the encrypted files on your PC by clicking Next.\r\nhttps://decoded.avast.io/threatresearch/decrypted-akira-ransomware/\r\nPage 6 of 8\n\n7. On the final page, you can opt-in to back up your encrypted files. These backups may help if anything goes\r\nwrong during the decryption process. This choice is selected by default, which we recommend. After clicking\r\nDecrypt the decryption process begins. Let the decryptor work and wait until it finishes decrypting all of your\r\nfiles.\r\nFor questions or comments about the Avast decryptor, email decryptors@avast.com.\r\nIOCs (indicators of compromise)\r\nWindows versions\r\n3c92bfc71004340ebc00146ced294bc94f49f6a5e212016ac05e7d10fcb3312c\r\n5c62626731856fb5e669473b39ac3deb0052b32981863f8cf697ae01c80512e5\r\n678ec8734367c7547794a604cc65e74a0f42320d85a6dce20c214e3b4536bb33\r\n7b295a10d54c870d59fab3a83a8b983282f6250a0be9df581334eb93d53f3488\r\n8631ac37f605daacf47095955837ec5abbd5e98c540ffd58bb9bf873b1685a50\r\n1b6af2fbbc636180dd7bae825486ccc45e42aefbb304d5f83fafca4d637c13cc\r\n9ca333b2e88ab35f608e447b0e3b821a6e04c4b0c76545177890fb16adcab163\r\nd0510e1d89640c9650782e882fe3b9afba00303b126ec38fdc5f1c1484341959\r\n6cadab96185dbe6f3a7b95cf2f97d6ac395785607baa6ed7bf363deeb59cc360\r\nLinux version\r\nhttps://decoded.avast.io/threatresearch/decrypted-akira-ransomware/\r\nPage 7 of 8\n\n1d3b5c650533d13c81e325972a912e3ff8776e36e18bca966dae50735f8ab296\r\nThreat Research Team\r\nThreat Research Team\r\nA group of elite researchers who like to stay under the radar.\r\nSource: https://decoded.avast.io/threatresearch/decrypted-akira-ransomware/\r\nhttps://decoded.avast.io/threatresearch/decrypted-akira-ransomware/\r\nPage 8 of 8", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia" ], "origins": [ "web" ], "references": [ "https://decoded.avast.io/threatresearch/decrypted-akira-ransomware/" ], "report_names": [ "decrypted-akira-ransomware" ], "threat_actors": [ { "id": "8c8fea8c-c957-4618-99ee-1e188f073a0e", "created_at": "2024-02-02T02:00:04.086766Z", "updated_at": "2026-04-10T02:00:03.563647Z", "deleted_at": null, "main_name": "Storm-1567", "aliases": [ "Akira", "PUNK SPIDER", "GOLD SAHARA" ], "source_name": "MISPGALAXY:Storm-1567", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "910b38e9-07fe-4b47-9cf4-e190a07b1b84", "created_at": "2024-04-24T02:00:49.516358Z", "updated_at": "2026-04-10T02:00:05.309426Z", "deleted_at": null, "main_name": "Akira", "aliases": [ "Akira", "GOLD SAHARA", "PUNK SPIDER", "Howling Scorpius" ], "source_name": "MITRE:Akira", "tools": [ "Mimikatz", "PsExec", "AdFind", "Akira _v2", "Akira", "Megazord", "LaZagne", "Rclone" ], "source_id": "MITRE", "reports": null } ], "ts_created_at": 1775434890, "ts_updated_at": 1775826739, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/83ad2b221a3a802e03885442870d93e6784d6f96.pdf", "text": "https://archive.orkl.eu/83ad2b221a3a802e03885442870d93e6784d6f96.txt", "img": "https://archive.orkl.eu/83ad2b221a3a802e03885442870d93e6784d6f96.jpg" } }