MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 421a4ad4b0a8ac700f33745f7377a27ca6dc5e69031fe2cd6d16ce6d8ba5f498. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AkumaStealer

Vendor detections: 9

Intelligence 9 IOCs YARA 10 File information Comments

SHA256 hash:	421a4ad4b0a8ac700f33745f7377a27ca6dc5e69031fe2cd6d16ce6d8ba5f498
SHA3-384 hash:	ab3256db9c18f06c471745545ee85ea402acba6520f7612fdc1dc953a4911731db271ccc223e3462c8672f89974dcdc9
SHA1 hash:	6f9b09d5c9405fe8f6b3ad4290c589ad047f7a1a
MD5 hash:	e4025ca20f5439efbcf96cb7b38a8c24
humanhash:	alanine-sodium-low-nevada
File name:	Order_details_40353.pdf.zip
Download:	download sample
Signature	AkumaStealer Create hunting rule
File size:	192'241 bytes
First seen:	2026-10-28 10:47:55 UTC
Last seen:	2026-10-28 10:49:15 UTC
File type:	zip
MIME type:	application/zip
ssdeep	3072:c19zWSyv+nFM/jemovJWnS4wAonYI5YaOK6DCW9XfOdij7hmFo7hOZK6AvxJlcwk:S9zekcZovJW+AlIICu5EFocEvvB5Q
TLSH	T1EC14125D7013783AD1CE050F5AD9B2E68B72EF2DDB0284414BCB91E0EDA6B486913DCE
Magika	zip
Reporter	TomU
Tags:	AkumaStealer zip

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Order_details_40353.pdf.exe
File size:	197'120 bytes
SHA256 hash:	abc6d5128aebe4cc8071cbba5e54d2bcdb57dfd116eec15b7b38858f2e66f5a8
MD5 hash:	414b9be01f563e769d9be33d22e9fc52
MIME type:	application/x-dosexec
Signature	AkumaStealer

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/55fa5a92-c80e-464b-b503-505e38e630f0/

Detection(s):

Sanesecurity.Foxhole.Zip_fs2008.UNOFFICIAL

Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL

Sanesecurity.Malware.22887.ZipHeur.UNOFFICIAL

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL

Sanesecurity.Malware.29905.BadZip_ObsPdfExe.UNOFFICIAL

Win.Trojan.Suspect-34

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae1d30349621540087c2452

Tags:

agenttesla underscore

Result

Verdict:

Malicious

File Type:

PE File in E-Mail

Link:

https://app.docguard.net/421a4ad4b0a8ac700f33745f7377a27ca6dc5e69031fe2cd6d16ce6d8ba5f498/results/dashboard

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/421a4ad4b0a8ac700f33745f7377a27ca6dc5e69031fe2cd6d16ce6d8ba5f498

Verdict:

Malicious

File Type:

zip

First seen:

2026-10-21T21:23:00Z UTC

Last seen:

2026-10-29T08:27:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/421a4ad4b0a8ac700f33745f7377a27ca6dc5e69031fe2cd6d16ce6d8ba5f498/results?tab=lookup

Score:

97%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

5/10

Tags:

defense_evasion upx

Link:

https://tria.ge/reports/261028-nfn8aaz1ez/

Behaviour

Suspicious use of NtSetInformationThreadHideFromDebugger

UPX packed file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.14

Link:

https://yomi.yoroi.company/submissions/421a4ad4b0a8ac700f33745f7377a27ca6dc5e69031fe2cd6d16ce6d8ba5f498

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	suspicious_PEs Create hunting rule
Author:	txc
Description:	This rule detected suspicious PE files, based on high entropy and low amount of imported DLLs. This behaviour indicates packed files or files, that hide their true intention.

Rule name:	SUSP_Archive_Phishing_Attachment_Characteristics_Jun22_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects characteristics of suspicious file names or double extensions often found in phishing mail attachments
Reference:	https://twitter.com/0xtoxin/status/1540524891623014400?s=12&t=IQ0OgChk8tAIdTHaPxh0Vg

Rule name:	SUSP_Archive_Phishing_Attachment_Characteristics_Jun22_1 Create hunting rule
Author:	Florian Roth
Description:	Detects characteristics of suspicious file names or double extensions often found in phishing mail attachments
Reference:	https://twitter.com/0xtoxin/status/1540524891623014400?s=12&t=IQ0OgChk8tAIdTHaPxh0Vg

Rule name:	UPX Create hunting rule
Author:	kevoreilly
Description:	UPX Unpacker: dump on OEP (original entry point)

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AkumaStealer

zip 421a4ad4b0a8ac700f33745f7377a27ca6dc5e69031fe2cd6d16ce6d8ba5f498

(this sample)

Delivery method

Distributed via e-mail attachment

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample