Strings & IOCs

Every indicator here comes from this binary or from our own controlled runs. None is taken from external reporting. Machine-readable copy: artifacts/iocs.csv.

Method

• Static: Ghidra list_strings / search_strings (artifacts/ghidra/strings*.txt) and read_memory of .data / .rdata.
• Decoded: stack strings and .rdata tables decoded offline with the per-string affine mod-127 scheme (03-static/07-string-obfuscation.md). The shadow-copy command was also confirmed live in x64dbg.
• Runtime: the ransom note, .arika journal and .akira footer were observed being written in runs 2 and 3.

Network

| Type | Value | Context (addr/function) | Confidence | |—|—|—|—| | Onion (leak blog) | akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion | ransom note text @ 0x1400ef060 | High | | Onion (negotiation chat) | akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion | ransom note text @ 0x1400ef060 | High | | Victim / campaign code | 6188-EA-ABYW-YGRG | ransom note chat login | High |

The binary itself makes no network connections: there is no socket, HTTP or DNS use.

Filesystem

| Path | Operation | Context | Confidence | |—|—|—|—| | <file>.akira | rename of each encrypted file (original + 512-byte footer) | FUN_1400ae840, SetFileInformationByHandle(FileRenameInfo) | High, live | | <file>.arika | per-file 532-byte journal, created then deleted | FUN_1400adb00 | High, live | | <folder>\akira_readme.txt | ransom note, one per traversed folder | FUN_140042420 | High, live | | Log-DD-MM-YYYY-HH-MM-SS.txt | operator log in the working directory | FUN_14004c6f0 | High, live |

Registry

| Key | Value | Purpose | Context | |—|—|—|—| | – | – | none: the binary writes no registry keys and has no persistence | – |

Mutex / named objects

| Name | Context | |—|—| | – | none created |

Process / command line

| Indicator | Context | |—|—| | powershell.exe -Command "Get-WmiObject Win32_Shadowcopy \| Remove-WmiObject" | launched hidden via WMI Win32_Process.Create; parent is WmiPrvSE.exe (FUN_140071d80 → FUN_140071620) | | --encryption_path=, --share_file=, --encryption_percent=, -localonly, -l (short -p= -s= -n=) | operator CLI (UTF-16 strings) |

Crypto material

| Type | Value | Context | |—|—|—| | RSA-4096 public key (DER RSAPublicKey, 526 B) | SHA-256 a40a55f2600b9199181bc6c0778e64b2e75145c4e6f715da6d23a72407539aaa, SHA-1 21e71c6c54ce479b206fa1f6ad3ab14c506a18e4, e = 65537, modulus begins c2f8f4dbbe7da09f7c991d69e00b4466 | .data @ 0x1400ee010; saved as artifacts/akira_rsa4096_public_key.der / .pem | | ChaCha constant | expand 32-byte kexpand 16-byte k | ChaCha key setup (FUN_14007c570) | | KCipher-2 amul0 table head | 00 00 00 00 1A 6D 08 B6 34 DA 10 AF 2E B7 18 19 | KCipher-2 core |

Notable plaintext strings

• Log lines: ` Number of threads to encrypt = , Number of thread to root folder parsers = , This is local disk: , This is network disk: , file rename failed. System error:, Failed to make full encrypt! (, Failed to make spot encrypt! (, Failed to make part encrypt! (, (Full begin) Cipher is not initialize!, write_encrypt_info error:, asio::create_auto_save_file error:`.
• Note file name akira_readme.txt; extensions .akira, .arika.
• Ransom note full text: artifacts/akira_readme.txt.

Exclusion lists (from static-initializer sets)

• Folders (0x1400f5e18): tmp, winnt, temp, thumb, $Recycle.Bin, $RECYCLE.BIN, System Volume Information, Boot, Windows, Trend Micro, ProgramData.
• Extensions (0x1400f5e08): .exe .dll .lnk .sys .msi, plus .akira .arika added at runtime.
• Protected processes (0x1400f5e28, 20 names): spoolsv.exe, fontdrvhost.exe, cmd.exe, explorer.exe, sihost.exe, SearchUI.exe, lsass.exe, dwm.exe, LogonUI.exe, winlogon.exe, services.exe, csrss.exe, smss.exe, System Idle Process, Secure System, conhost.exe, System, wininit.exe, Registry, Memory Compression.

Encoded / obfuscated strings

• Encoding scheme: per-string affine cipher mod 127 over stack-built or .rdata bytes.
• Decode routines: FUN_140071d80 (shadow-copy command), FUN_140034500 (20 VM-disk extensions), FUN_140003680 (153 database extensions).
• Decoded set: artifacts/decoded/db_extensions.txt, with the per-table keys in artifacts/decoded/dbext_groups.json. The full lists are in 03-static/04-encryption-modes.md.