MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 abc6d5128aebe4cc8071cbba5e54d2bcdb57dfd116eec15b7b38858f2e66f5a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AkumaStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 4 File information Comments

SHA256 hash:	abc6d5128aebe4cc8071cbba5e54d2bcdb57dfd116eec15b7b38858f2e66f5a8
SHA3-384 hash:	40cb1fcf9f23b4f378cf4e513d12c8902bcdf2df11083fdf8a543f962011ba7850382b64261758ec446b7dac3762bbad
SHA1 hash:	5b6c234af55c80dee1a31a7d39e0bbfb0a086314
MD5 hash:	414b9be01f563e769d9be33d22e9fc52
humanhash:	twenty-two-timing-helium
File name:	Order_details_40353.pdf.exe
Download:	download sample
Signature	AkumaStealer Create hunting rule
File size:	197'120 bytes
First seen:	2026-10-28 10:47:51 UTC
Last seen:	2026-10-28 11:36:43 UTC
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	6ed4f5f04d62b18d96b26d6db7c18840 (1'004 x SalatStealer, 78 x BitRAT, 49 x Vidar)
ssdeep	3072:sqrR+9b/TMUsXtU4ZuZldSie6TEd2hoAa8OugMIsJc+KwYqenbFlLv5nNFTrWeTt:7ro1bMUQ4REYhoAbVIJ5ZbFZRNFWeT
TLSH	T1C41412B4A19FD1D3E676C638E5FE8C5217E70C29CADBA0361785F419F072AC708A3A54
TrID	33.6% (.EXE) OS/2 Executable (generic) (2029/13) 33.1% (.EXE) Generic Win/DOS Executable (2002/3) 33.1% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	TomU
Tags:	AkumaStealer exe UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	197'120 bytes
File size (de-compressed) :	644'608 bytes
Format:	win64/pe
Unpacked file:	4fb163015991eaf4cfaf24c2af277c4f0987474a3c48bc8f998a14b3c9a1001d

Intelligence

File Origin

# of uploads :

# of downloads :

147

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

PEPacker

Details

Link:

https://research.acce.ciphertechsolutions.com/results/ff1c5ccf-9a95-4fa4-9583-0fa467c3d9c8/

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-10-28 11:09:07 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/0029004d-bc44-4252-9da1-7f0cbc8ff53f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/95721/

Detection(s):

SecuriteInfo.com.Trojan.Siggen36.44334.12985.19089.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae1d30349621540087c2452

Tags:

agenttesla underscore

Gathering data

Verdict:

Malicious

Labled as:

AgentTesla.Generic

Link:

https://www.hybrid-analysis.com/sample/abc6d5128aebe4cc8071cbba5e54d2bcdb57dfd116eec15b7b38858f2e66f5a8

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-21T21:13:00Z UTC

Last seen:

2026-10-26T22:06:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/abc6d5128aebe4cc8071cbba5e54d2bcdb57dfd116eec15b7b38858f2e66f5a8/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/a57ced60-bbe5-446c-9c0c-82ff4898cea9

Result

Threat name:

Akuma Stealer

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1993893

Signature

Contain functionality to detect virtual machines

Found direct / indirect Syscall (likely to bypass EDR)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Potentially malicious time measurement code found

Sets debug register (to hijack the execution of another thread)

Sigma detected: Suspicious Double Extension File Execution

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal from password manager

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected Akuma Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

97%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/abc6d5128aebe4cc8071cbba5e54d2bcdb57dfd116eec15b7b38858f2e66f5a8

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout UPX UPX Header Tampered Win 64 Exe x64

Link:

https://app.malva.re/file/414b9be01f563e769d9be33d22e9fc52

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/abc6d5128aebe4cc8071cbba5e54d2bcdb57dfd116eec15b7b38858f2e66f5a8/

Threat name:

Win64.Trojan.AgentTesla

Status:

Malicious

First seen:

2026-10-22 02:01:37 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

25 of 36 (69.44%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vpdnkeuk5psmzadrzo5f4vgsxtnvpx6rc3xmcw33hccy6ltg6wua._file

Result

Malware family:

n/a

Score:

5/10

Tags:

defense_evasion upx

Link:

https://tria.ge/reports/261028-mwbrfsga63/

Behaviour

Suspicious use of NtSetInformationThreadHideFromDebugger

UPX packed file

Unpacked files

SH256 hash:

abc6d5128aebe4cc8071cbba5e54d2bcdb57dfd116eec15b7b38858f2e66f5a8

MD5 hash:

414b9be01f563e769d9be33d22e9fc52

SHA1 hash:

5b6c234af55c80dee1a31a7d39e0bbfb0a086314

Detections:

SUSP_Imphash_Mar23_3

Link:

https://www.unpac.me/results/548e8e82-862f-459e-8d9b-a0644e649cd8/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.89

Link:

https://yomi.yoroi.company/submissions/abc6d5128aebe4cc8071cbba5e54d2bcdb57dfd116eec15b7b38858f2e66f5a8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	suspicious_PEs Create hunting rule
Author:	txc
Description:	This rule detected suspicious PE files, based on high entropy and low amount of imported DLLs. This behaviour indicates packed files or files, that hide their true intention.

Rule name:	UPX Create hunting rule
Author:	kevoreilly
Description:	UPX Unpacker: dump on OEP (original entry point)

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.