SIGNATURE_BASE_MAL_WIN_Akira_Apr25

rule SIGNATURE_BASE_MAL_WIN_Akira_Apr25 : FILE
{
	meta:
		description = "This Yara rule from ISH Tecnologia's Heimdall Security Research Team detects key components of Akira Ransomware"
		author = "0x0d4y-Icaro Cesar"
		id = "76722cb6-70be-465f-9ef1-afd78f694289"
		date = "2025-04-11"
		modified = "2026-05-15"
		reference = "https://ish.com.br/wp-content/uploads/2025/04/A-Anatomia-do-Ransomware-Akira-e-sua-expansao-multiplataforma.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_win_akira_apr25.yar#L1-L28"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "205589629ead5d3c1d9e914b49c08589"
		logic_hash = "112f844dff4c48d861f86736503da51e8fbc58805f463df1f9358781034f2e24"
		score = 90
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		rule_matching_tlp = "TLP:WHITE"
		rule_sharing_tlp = "TLP:WHITE"
		malpedia_family = "win.akira"

	strings:
		$code_custom_algorithm = { 44 8B CF 90 42 0F B6 4C 0D ?? 83 E9 4E 44 8D 04 89 45 03 C0 B8 09 04 02 81 41 F7 E8 41 03 D0 C1 FA 06 8B C2 C1 E8 1F 03 D0 6B C2 7F 44 2B C0 41 83 C0 7F B8 09 04 02 81 41 F7 E8 41 03 D0 C1 FA 06 8B C2 C1 E8 1F 03 D0 6B C2 7F 44 2B C0 46 88 44 0D ?? 49 FF C1 }
		$code_aes_key_expansion = { 41 8D 41 FF 33 D2 8B 0C ?? 41 8B C1 41 F7 F2 85 D2 75 ?? 44 8B C1 0F B6 C1 0F B6 0C ?? 41 8B C0 48 C1 E8 ?? C1 E1 ?? 0F B6 04 ?? 0B C8 41 8B C0 48 C1 E8 ?? C1 E1 ?? 0F B6 D0 49 C1 E8 ?? 0F B6 04 ?? 0B C8 41 0F B6 C0 C1 E1 ?? 0F B6 14 ?? 0F B6 45 00 0B CA 33 C8 48 FF C5 }
		$akira_str_I = "akira" ascii
		$akira_str_II = "onion" ascii
		$akira_str_III = "powershell" ascii
		$akira_str_IV = "akira_readme.txt" ascii

	condition:
		uint16( 0 ) == 0x5a4d and all of ( $code_* ) and all of ( $akira_str_* )
}