# Akira Ransomware: Recovering Files Without the Key

<p align="center">
  <img src="Assets/hero.jpg" alt="Breaking Akira's clock" width="600px">
</p>

This folder covers an Akira-branded Windows x64 encryptor and a **working decryptor that needs no ransom key**.
Every per-file key the sample uses comes from a fresh Yarrow-256 generator seeded only with the machine's
uptime counter. A responder who reads the victim's clock on the same boot can therefore rebuild the keys
from each file's timestamp.

- **Write-up:** [shaddy43.com/MalwareAnalysisSeries/Akira](https://shaddy43.com/MalwareAnalysisSeries/Akira/).
  A standalone copy is in [`Akira-Recovery-Blog.html`](./Akira-Recovery-Blog.html).
- **Decryptor:** [`tools_and_scripts/`](./tools_and_scripts). Pure Python 3.8+, with an optional numba engine at about 25 s per file.
- **Full case files:** [`analysis/`](./analysis). These are the static notes, every controlled run, raw tool output, the logs and the tests.
- **Samples:** [`sample/`](./sample). Password **infected**.
- **Detections:** [`Extracted_TTPs/`](./Extracted_TTPs). YARA, Sigma and hunting notes, each mapped to ATT&CK.

> ⚠️ The samples are live ransomware. Detonate them only in an isolated, snapshotted VM. See [SECURITY.md](../SECURITY.md).

## Builds analysed

| Build | SHA-256 | Result |
|---|---|---|
| Build 1 | `101bd45ab673fd6547386dff4339f1649e61b9f5c318260d365f766fbdc2d3c9` | Full static + 6 controlled runs. Blind recovery of real files: run 5 **4/4**; run 6 (independent, rules frozen beforehand) **6/7**; with the PDF stage-2 fallback added afterwards, **7/7** recoverable |
| Build 2 | `988776358d0e45a4907dc1f4906a916f1b3595a31fa44d8e04e563a32557eb42` | Same codebase (static comparison), with build 1's decryptor **unchanged**: **6/7**; with the PDF stage-2 fallback, **7/7** recoverable |

In both blind runs, the one in-scope file not recovered in full was a large PDF. Over about 262 KB, the middle of
the encrypted half also uses ChaCha8. Its KCipher-2 keys were found, but the generic zeros/text check rejected the right
ChaCha8 key, because the first ChaCha8 chunk starts in compressed data. The decryptor now retries PDFs with two PDF-specific
checks: exact object headers from the xref, and continuing a page-content stream's deflate. That recovers both PDFs
hash-exact with the default command line. Other large compressed files (Office documents, archives, video) can still come
back partly decrypted.

## Akira Ransomware TTPs
<table>
  <thead>
    <tr>
      <th>TTP</th>
      <th>Description</th>
      <th>Code</th>
      <th>Detection</th>
    </tr>
  </thead>
  <tbody>
    <tr>
      <td><a href="https://attack.mitre.org/techniques/T1486/" target="_blank">Impact: Data Encrypted for Impact</a></td>
      <td>ChaCha8 + KCipher-2 in Full / Spot / Part modes, per-file keys wrapped with RSA-4096 into a 512-byte footer, <code>.akira</code> rename via a <code>.arika</code> journal</td>
      <td><a href="./tools_and_scripts">Decryptor</a> (re-implements every cipher; the round-trip tests also encrypt)</td>
      <td><a href="./Extracted_TTPs/Akira_Encrypter/Detection">Rule/Query</a></td>
    </tr>
    <tr>
      <td><a href="https://attack.mitre.org/techniques/T1490/" target="_blank">Impact: Inhibit System Recovery</a></td>
      <td>Deletes Volume Shadow Copies with PowerShell, launched hidden through WMI <code>Win32_Process.Create</code></td>
      <td>Not recreated</td>
      <td><a href="./Extracted_TTPs/Akira_DeleteShadowCopies/Detection">Rule/Query</a></td>
    </tr>
    <tr>
      <td><a href="https://attack.mitre.org/techniques/T1489/" target="_blank">Impact: Service Stop</a></td>
      <td>Restart Manager <code>RmShutdown(RmForceShutdown)</code> on processes that lock target files, sparing a list of 20 system processes</td>
      <td>Not recreated</td>
      <td><a href="./Extracted_TTPs/Akira_RestartManagerKill/Detection">Rule/Query</a></td>
    </tr>
  </tbody>
</table>

Observed without a recreated TTP:
- [T1047](https://attack.mitre.org/techniques/T1047/) WMI;
- [T1059.001](https://attack.mitre.org/techniques/T1059/001/) PowerShell;
- [T1564.003](https://attack.mitre.org/techniques/T1564/003/) Hidden Window;
- [T1027](https://attack.mitre.org/techniques/T1027/) obfuscated strings;
- [T1057](https://attack.mitre.org/techniques/T1057/), [T1083](https://attack.mitre.org/techniques/T1083/), [T1135](https://attack.mitre.org/techniques/T1135/) and [T1082](https://attack.mitre.org/techniques/T1082/) discovery.

Evidence for each is in [`analysis/2026-10-11_101bd45ab673_akira-ransomware/05-detections/01-detections.md`](./analysis/2026-10-11_101bd45ab673_akira-ransomware/05-detections/01-detections.md).

## Decryptor quick start

```bash
cd tools_and_scripts
python akira_decrypt.py selftest

# keys known (e.g. from the operator's private key, or a previous recovery)
python akira_decrypt.py decrypt report.pdf.akira --keys <key1>:<iv1>:<key2>:<iv2> --out report.pdf

# no keys: rebuild them from the file's timestamp and one clock reading taken on the SAME boot
python akira_decrypt.py recover report.pdf.akira \
    --qpc-offset <FILETIME of QPC 0> --mtime <file last-write FILETIME> \
    --known-hex 255044462d312e --out report.pdf

# if that misses: second pass anchored on iv2, wider seed gap
python akira_decrypt.py recover photo.png.akira --qpc-offset ... --mtime ... \
    --anchor iv2 --mtime-window 2.5:0.1 --gap 8001:30000 --out photo.png
```

`pip install numpy numba` turns on the compiled search (`akira_fast.py`), which takes a file from about
30 minutes to about 25 seconds. The clock reading comes from
[`collect_clock_and_times.ps1`](./tools_and_scripts/collect_clock_and_times.ps1). Run it on the victim
**before any reboot**. The decryptor README covers all the options and its limits.

## Contents

```
Akira/
├── README.md
├── index.md                         the write-up (site page)
├── Akira-Recovery-Blog.html         standalone copy of the write-up
├── Assets/                          hero image + flow diagrams
├── sample/                          password-protected sample archives (infected)
├── tools_and_scripts/               decryptor, numba engine, responder collector
├── Extracted_TTPs/                  detections per TTP
└── analysis/
    ├── 2026-10-11_101bd45ab673_akira-ransomware/   build 1 case file
    │   ├── 00-intake … 05-detections                notes, in order of work
    │   ├── 04-dynamic/                              runs 1-6: protocols, listings, drivers, results
    │   ├── 06-decryptor/                            decryptor + tests + zero-filled .akira fixtures
    │   ├── artifacts/                               raw tool output, run logs, IOCs, RSA public key
    │   ├── scripts/                                 cipher re-implementations used during analysis
    │   ├── NOTES.md                                 append-only audit trail
    │   └── report.md                                full technical report
    └── 2026-10-13_988776358d0e_akira-build2/       build 2 case file (static comparison + blind run)
```

**Left out on purpose:**
- the encrypted and decrypted copies of the analyst's own test documents. Every listing, log and SHA-256 comparison is kept;
- the samples themselves, which go in `sample/` as archives.

All findings come from our own reverse engineering and controlled detonations. No external reporting was used.