🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b28bb26e2c8f1452fa3f6f006d969de58cd965dc9ba81b824a78a0bfaf6c57e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b28bb26e2c8f1452fa3f6f006d969de58cd965dc9ba81b824a78a0bfaf6c57e2
SHA3-384 hash: 03f54e7ddf2cd8c44a5413187aec4f1179bbbc86cafddd8adfd8774b2ed6559ece553b53e5051326a02b26abd130907e
SHA1 hash: 072130852719f4d578e137954985344c60f8342d
MD5 hash: 4981d8e89899a1e33dc29f13c60d399b
humanhash: ack-cold-fish-hawaii
File name:vedbux.exe
Download: download sample
Signature Stealc
Create hunting rule
File size:242'176 bytes
First seen:2026-01-18 13:00:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 00e004ff0649be67e6fbb756d37edeca (2 x Stealc)
ssdeep 6144:7g3gtnmRPCbvN8EeeDb0ZH0mTznfSYiH9n2edO:cymRPCbvN8EeeDbcnqPx2A
TLSH T178348E21B992C432C66B09B39879DF69493DFC514B7165C7A3C41EFECA206C1AF35A0B
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter ng0kp
Tags:exe Stealc

Intelligence

File Origin
# of uploads :
1
# of downloads :
134
Origin country :
ID ID
Vendor Threat Intelligence
Malware configuration found for:
Diamotrix
Details
Diamotrix
cryptocurrency addresses and possibly a mutex
Link:
https://research.acce.ciphertechsolutions.com/results/c46666eb-8c0d-4359-be90-907d784318d9/
Malware family:
n/a
ID:
1
File name:
vedbux.exe
Verdict:
Suspicious activity
Analysis date:
2026-01-18 13:03:15 UTC
Tags:
crypto-regex
Link:
https://app.any.run/tasks/0757ee32-848a-4f8c-b18c-d256658de3da

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/49218/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=696cd984ef906a21abce41cd
Tags:
vmdetect virus zusy
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
clipbanker fingerprint microsoft_visual_cc zusy
Link:
https://www.filescan.io/uploads/696cd9789c4da7d847356e45/reports/67b3c3f8-de59-48dd-a5aa-42447a5c291f/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/b28bb26e2c8f1452fa3f6f006d969de58cd965dc9ba81b824a78a0bfaf6c57e2
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-17T21:13:00Z UTC
Last seen:
2026-01-19T15:23:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.Udochka.sb VHO:Trojan-PSW.Win32.Greedy.gen VHO:Trojan.Win32.Udochka.gen VHO:Backdoor.Win32.Agent.gen Trojan-PSW.Win32.Greedy.sb Trojan.Win32.Udochka.dej
Link:
https://opentip.kaspersky.com/b28bb26e2c8f1452fa3f6f006d969de58cd965dc9ba81b824a78a0bfaf6c57e2/results?tab=lookup
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0f4aee01-86f1-4bb3-8ac9-caa99bc70b82
Score:
92%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b28bb26e2c8f1452fa3f6f006d969de58cd965dc9ba81b824a78a0bfaf6c57e2
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/4981d8e89899a1e33dc29f13c60d399b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b28bb26e2c8f1452fa3f6f006d969de58cd965dc9ba81b824a78a0bfaf6c57e2/
Verdict:
Malicious
Threat:
VHO:Trojan.Win32.Udochka
Link:
https://tip.neiki.dev/file/b28bb26e2c8f1452fa3f6f006d969de58cd965dc9ba81b824a78a0bfaf6c57e2
Threat name:
Win32.Infostealer.Tinba
Create hunting rule
Status:
Malicious
First seen:
2026-01-18 00:28:07 UTC
File Type:
PE (Exe)
AV detection:
19 of 38 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wkf3e3rmr4kff6r7n4ag3fu54wgnszo4toubxaskpcql7l3mk7ra._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/260118-p81mfsbv3b/
Behaviour
System Location Discovery: System Language Discovery
Drops file in Windows directory
Enumerates connected drives
Reads user/profile data of web browsers
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3f10824d-eb5a-4803-9f3e-c46a31d4803e
Unpacked files
SH256 hash:
b28bb26e2c8f1452fa3f6f006d969de58cd965dc9ba81b824a78a0bfaf6c57e2
MD5 hash:
4981d8e89899a1e33dc29f13c60d399b
SHA1 hash:
072130852719f4d578e137954985344c60f8342d
Link:
https://www.unpac.me/results/50ca92bd-a147-4e66-986c-c3753d66f3dd/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b28bb26e2c8f1452fa3f6f006d969de58cd965dc9ba81b824a78a0bfaf6c57e2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/49218/

Comments