Akira Active

rule Akira_Ransomware {
    meta:
        description = "Detects Akira ransomware"
        author = "Security Research"
    strings:
        $s1 = "akira_readme" ascii
        $s2 = "akira" ascii nocase
        $s3 = ".akira" ascii
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

Hi friends,

Whatever who you are and what your title is if you're reading this it means the
internal infrastructure of your company is fully or partially dead, all your
backups - virtual, physical - everything that we managed to reach - are completely
removed. Moreover, we have taken a great amount of your corporate data prior to encryption.

Well, for now let's keep all the tears and resentment to ourselves and try to
build a constructive dialogue. We're fully aware of what damage we caused by locking
your internal sources. At the moment, you have to know:
1. Dealing with us you will save A LOT due to we are not interested in ruining
   your financially. We will study in depth your finances, bank & income statements,
   your savings, investments etc. and present our reasonable demand to you.
   If you have an active cyber insurance, let us know and we will guide you
   how to properly use it. Also, dragging out the negotiation process will
   lead to failing of a deal.
2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within
   24 hours roughly. Our decryptor works properly on any files or systems,
   so you will be able to check it by requesting a test decryption.
3. If you decide not to cooperate, all your data will be published/sold.

Contact us:
http://akira[REDACTED].onion