Detections

The most reliable early signal is the shadow-copy deletion through PowerShell launched by WMI, which happens before any file is encrypted. After that, a burst of .arika creations followed by .akira renames is unmistakable.

YARA

Rule file: akira_win64_encryptor_101bd45a.yar.

rule Akira_Win64_Encryptor_101bd45a
{
    meta:
        description = "Akira-branded x64 encryptor (asio/C++20, ChaCha8 + KCipher-2, RSA-4096)"
        sha256      = "101bd45ab673fd6547386dff4339f1649e61b9f5c318260d365f766fbdc2d3c9"
        date        = "2026-10-11"
    strings:
        $n1 = "akira_readme.txt" ascii
        $n2 = ".arika" ascii
        $l1 = "write_encrypt_info error:" ascii
        $l2 = "(Full begin) Cipher is not initialize!" ascii
        $l3 = "asio::create_auto_save_file error:" ascii
        $l4 = "Failed to make spot encrypt! (" ascii
        $l5 = "Number of thread to root folder parsers = " ascii
        $c1 = "--encryption_percent" wide
        $c2 = "--share_file" wide
        $c3 = "-localonly" wide
        $k2 = { 00 00 00 00 1A 6D 08 B6 34 DA 10 AF 2E B7 18 19 }   // KCipher-2 amul0 table
        $cc = "expand 32-byte kexpand 16-byte k" ascii
    condition:
        uint16(0) == 0x5A4D and filesize < 3MB and
        ( (1 of ($n*) and 4 of ($l*, $c*)) or ($k2 and $cc and 3 of ($l*, $c*)) )
}

Tested against: not run by a YARA engine. There is no YARA on the host and the sample stays on the VM. Every string and byte pattern was confirmed present in this binary through Ghidra, including the ASCII vs UTF-16 encoding of each string.
False-positive considerations: log strings and CLI names are specific to this codebase. The KCipher-2 table plus the ChaCha constants on their own could match legitimate crypto libraries, so that branch also requires three of the codebase strings. Run against a benign corpus before promoting to reference/yara/.

Sigma / host telemetry

title: Akira 101bd45a - shadow copies removed by WMI-spawned hidden PowerShell
status: experimental
logsource: { category: process_creation, product: windows }
detection:
  selection:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith: '\powershell.exe'
    CommandLine|contains|all: ['Win32_Shadowcopy', 'Remove-WmiObject']
  condition: selection
level: high
tags: [attack.impact, attack.t1490, attack.execution, attack.t1047, attack.t1059.001]

title: Akira 101bd45a - operator launch syntax
status: experimental
logsource: { category: process_creation, product: windows }
detection:
  selection:
    CommandLine|contains: ['--encryption_path=', '--share_file=', '--encryption_percent=']
  flag:
    CommandLine|contains: '-localonly'
  condition: selection or flag
level: high

Both rules are written from the observed behaviour and have not been tested against a log corpus.

Signal	Source	Why it fires
`WmiPrvSE.exe` → `powershell.exe` with `Win32_Shadowcopy` and `Remove-WmiObject`	Sysmon 1 / 4688, PowerShell 4104	shadow-copy deletion via `Win32_Process.Create`, hidden window
Bursts of `.arika` creates, then the same paths renamed to `.akira`	Sysmon 11 / EDR rename telemetry	per-file journal plus `FileRenameInfo` rename
`akira_readme.txt` created in many folders within seconds	file events	note dropped per traversed folder
Rapid Restart Manager sessions from an unsigned process, then terminations of database or Office processes	Application log RestartManager 10000/10001, process termination	`RmShutdown(RmForceShutdown)` on file lockers
New `Log-??-??-????-??-??-??.txt` next to an unknown executable	file events	built-in operator log

Network signatures

None applicable: the binary has no network activity. The onion addresses are for out-of-band victim contact only (see 02-strings-iocs/).

Hunting queries

API-sequence anchor (EDR / ETW), in order from one unsigned process:
1. WTSEnumerateProcessesW;
2. COM WbemLocator → Win32_Process.Create with a hidden Win32_ProcessStartup;
3. many RmStartSession / RmShutdown(RmForceShutdown) pairs;
4. overlapped ReadFile/WriteFile at the same offsets;
5. SetFileInformationByHandle(FileRenameInfo) to *.akira. Call sites are in 03-static/09-api-behaviour-map.md.
Files ending .akira whose size is ≥ 512 and whose last 512 bytes are high-entropy, next to akira_readme.txt.
Leftover *.arika files of exactly 532 bytes. These are interrupted encryptions, and they still carry the RSA blob and progress mark.

ATT&CK mapping