Hybrid Malware Analysis for Threat Intelligence: Unveiling Akira Ransomware

Abstract

This paper presents an in-depth technical analysis of the Akira ransomware family, which has emerged as a prominent threat in the cybersecurity landscape between 2023 and 2025. Known for its advanced encryption techniques, anti-analysis mechanisms and targeted extortion campaigns, Akira demonstrates a sophisticated evolution of modern ransomware.The study applies both static and dynamic analysis methodologies to deconstruct Akira’s behavior and internal structure. Static analysis using tools such as Ghidra, PEStudio and FLOSS is used to extract key artifacts, analyze its PE structure and examine its encryption implementation and obfuscation techniques. Complementary dynamic analysis is performed in controlled sandbox environments using Any.Run, Procmon and Wireshark, revealing the ransomware's real-time activities, including file encryption behavior, registry modifications and potential network communications with command-and-control (C2) infrastructure. The research identifies critical indicators of compromise (IOCs), analyzes the encryption flow involving ChaCha20 and RSA and documents Akira’s ransomware note deployment and persistence mechanisms. The findings aim to support the development of more effective detection, classification and response frameworks in malware analysis and threat intelligence operations. This paper highlights how hybrid analysis techniques can uncover both surface-level and deeply embedded functionalities of emerging ransomware variants like Akira.