MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a05c686d8661d0abbfde1b9619848b9041a63b7dcaf2ec36623fb5f5b811856. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GenesisStealer


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a05c686d8661d0abbfde1b9619848b9041a63b7dcaf2ec36623fb5f5b811856
SHA3-384 hash: 09497236228afcf2d3a60885b9b686744a057bf219bb0e2f74831947a06911cb8ee644f49a1d50c378c56163c55c74d9
SHA1 hash: d86d917410b5840c4d61952340519faab444c7eb
MD5 hash: 80dc4cf19c6cd92feb4a06f41fc3efb0
humanhash: undress-black-glucose-lake
File name:RPReplaySextapeleak13-2025-onlyfansleakfullvids.mp4.exe
Download: download sample
Signature GenesisStealer
Create hunting rule
File size:88'316'943 bytes
First seen:2025-11-14 12:54:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b34f154ec913d2d2c435cbd644e91687 (525 x GuLoader, 110 x RemcosRAT, 80 x EpsilonStealer)
ssdeep 1572864:2P+BWMFDe45ksCqFtw6hDRVOfdANnH7MZJ9HJLJ6fzoXzcA2fy7BlwhPyxQai6qL:22BFle45EUhDRVyA8HJLwfzoXzc7y7B+
Threatray 722 similar samples on MalwareBazaar
TLSH T1F31833093F75CD05E0EAC5BE27B233D21455B3872A99623BC57BD8AB42DCF11383A196
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter burger
Tags:exe GenesisStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RPReplaySextapeleak13-2025-onlyfansleakfullvids.mp4.exe
Verdict:
Malicious activity
Analysis date:
2025-11-14 12:52:42 UTC
Tags:
evasion arch-doc discord stealer possible-phishing generic nodejs
Link:
https://app.any.run/tasks/9438e23a-41fe-4892-ac3a-693686fd25ff

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69172616bdb0ec3a9dc15107
Tags:
shell spawn sage
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Creating a window
Searching for the window
Searching for the Windows task manager window
Running batch commands
Creating a process with a hidden window
Launching a process
Using the Windows Management Instrumentation requests
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context anti-debug blackhole fingerprint installer installer installer-heuristic masquerade microsoft_visual_cc nsis overlay packed
Link:
https://www.filescan.io/uploads/69172691253c565f83ff157b/reports/174b4737-8fd4-46b6-89d9-d905b18dcf25/overview
Verdict:
Suspicious
Link:
https://www.hybrid-analysis.com/sample/0a05c686d8661d0abbfde1b9619848b9041a63b7dcaf2ec36623fb5f5b811856
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-14T09:50:00Z UTC
Last seen:
2025-11-14T10:10:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-PSW.Script.Generic
Link:
https://opentip.kaspersky.com/0a05c686d8661d0abbfde1b9619848b9041a63b7dcaf2ec36623fb5f5b811856/results?tab=lookup
Result
Threat name:
Genesis Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.expl
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1814113
Signature
Adds a directory exclusion to Windows Defender
Attempt to bypass Chrome Application-Bound Encryption
Detected Genesis Stealer
Disables Windows Defender (via service or powershell)
Drops large PE files
Excessive usage of taskkill to terminate processes
Loading BitLocker PowerShell Module
Maps a DLL or memory area into another process
Modifies Windows Defender protection settings
Obfuscated command line found
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)
Queries sensitive system registry key value via command line tool
Sigma detected: Capture Wi-Fi password
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Potential Data Stealing Via Chromium Headless Debugging
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powershell Defender Disable Scan Feature
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal WLAN passwords
Unusual module load detection (module proxying)
Uses cmd line tools excessively to alter registry or file data
Uses netsh to modify the Windows network and firewall settings
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1814113 Sample: RPReplaySextapeleak13-2025-... Startdate: 14/11/2025 Architecture: WINDOWS Score: 100 63 www.python.org 2->63 65 uploads.227efc002310e6abf829b4c6a393bd4a.r2.cloudflarestorage.com 2->65 67 5 other IPs or domains 2->67 105 Sigma detected: Capture Wi-Fi password 2->105 107 Sigma detected: Powershell Defender Disable Scan Feature 2->107 109 Sigma detected: Invoke-Obfuscation CLIP+ Launcher 2->109 111 3 other signatures 2->111 8 RPReplaySextapeleak2025_onlyfansleakfullvids.mp4.exe 23 2->8         started        13 RPReplaySextapeleak2025_onlyfansleakfullvids.mp4.exe 2->13         started        15 RPReplaySextapeleak13-2025-onlyfansleakfullvids.mp4.exe 12 430 2->15         started        signatures3 process4 dnsIp5 69 ip-api.com 208.95.112.1, 49695, 80 TUT-ASUS United States 8->69 71 dualstack.python.map.fastly.net 151.101.128.223, 443, 49719 FASTLYUS United States 8->71 73 6 other IPs or domains 8->73 49 C:\Users\...behaviorgraphenesis_System_1763125164287.zip, Zip 8->49 dropped 51 C:\Users\user\AppData\Local\...\passwords.db, SQLite 8->51 dropped 53 C:\Users\user\AppData\Local\...\passwords.db, SQLite 8->53 dropped 115 Detected Genesis Stealer 8->115 117 Suspicious powershell command line found 8->117 119 Obfuscated command line found 8->119 131 4 other signatures 8->131 17 cmd.exe 8->17         started        20 powershell.exe 8->20         started        22 cmd.exe 8->22         started        26 89 other processes 8->26 121 Attempt to bypass Chrome Application-Bound Encryption 13->121 123 Modifies Windows Defender protection settings 13->123 125 Adds a directory exclusion to Windows Defender 13->125 127 Unusual module load detection (module proxying) 13->127 55 RPReplaySextapelea...eakfullvids.mp4.exe, PE32+ 15->55 dropped 57 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 15->57 dropped 59 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 15->59 dropped 61 19 other files (none is malicious) 15->61 dropped 129 Drops large PE files 15->129 24 cmd.exe 1 15->24         started        file6 signatures7 process8 dnsIp9 83 Uses cmd line tools excessively to alter registry or file data 17->83 85 Uses netsh to modify the Windows network and firewall settings 17->85 87 Adds a directory exclusion to Windows Defender 17->87 43 2 other processes 17->43 89 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 20->89 91 Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes) 20->91 93 Queries memory information (via WMI often done to detect virtual machines) 20->93 29 conhost.exe 20->29         started        95 Queries sensitive system registry key value via command line tool 22->95 45 2 other processes 22->45 31 conhost.exe 24->31         started        33 tasklist.exe 1 24->33         started        35 find.exe 1 24->35         started        81 chrome.cloudflare-dns.com 172.64.41.3, 443, 49696, 60011 CLOUDFLARENETUS United States 26->81 97 Excessive usage of taskkill to terminate processes 26->97 99 Maps a DLL or memory area into another process 26->99 101 Tries to harvest and steal WLAN passwords 26->101 103 Loading BitLocker PowerShell Module 26->103 37 powershell.exe 26->37         started        40 chrome.exe 26->40         started        47 117 other processes 26->47 signatures10 process11 dnsIp12 113 Loading BitLocker PowerShell Module 37->113 75 mail.google.com 142.251.40.197, 443, 49700 GOOGLEUS United States 40->75 77 tools.l.google.com 40->77 79 tools.google.com 40->79 signatures13
Score:
10%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/0a05c686d8661d0abbfde1b9619848b9041a63b7dcaf2ec36623fb5f5b811856
Gathering data
Verdict:
Malicious
Threat:
Trojan-PSW.Script
Link:
https://tip.neiki.dev/file/0a05c686d8661d0abbfde1b9619848b9041a63b7dcaf2ec36623fb5f5b811856
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bic4nbwymyoqvo754g4wdgcixecbuy5x3sxs5q3gep5v6w4bdbla._file
Verdict:
malicious
Label(s):
novablight
Create hunting rule
Similar samples:
04c235057ccb53c25e65bf1fec0bfff1f9ae2e70f1019055b9b8eb28359c205f
GenesisStealer
0c27b817cb613ba8ebebe3f3216f53a56e502bcd3fa5ecea6169be88410f5a89
GenesisStealer
3930988ec97fe425cf4441f22dc4dca0aa086b3c7100ee2f67e13fe80b804151
GenesisStealer
6bffe01c34b9ec6e91e6392b305ae7398918f7f996ae9858ea6c6d9b4499c6f0
GenesisStealer
9ffc66cfdbe4780957925370962a69757cb000b30e7dfa5788f160670364a326
GenesisStealer
a0c26a10466c6c8e6b92e4adc85cc99a970bb4d903b60adf5c1499e9b094d7b0
GenesisStealer
ad82b7225ce45378784a9e04a9021fd62bb5b1e5245ca76e8dd08317668824bd
GenesisStealer
c0ccd705314d4c791edfee20ef9f99e056dc82775a42edd8653668a492b72a11
GenesisStealer
eff32e547f049f4e21f6bee630a1f8aba488443e8d19ec535b496803d1b5ba11
GenesisStealer
error
GenesisStealer
+ 712 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
antivm credential_access defense_evasion discovery execution linux persistence privilege_escalation ransomware spyware stealer trojan
Link:
https://tria.ge/reports/251114-p5hmgabp2s/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Enumerates system info in registry
Kills process with taskkill
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Browser Information Discovery
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Wi-Fi Discovery
Drops file in Windows directory
Hide Artifacts: Ignore Process Interrupts
Launches sc.exe
Enumerates processes with tasklist
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Disables one or more Microsoft Defender components
Uses browser remote debugging
Windows security bypass
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/7c25fc79-41a4-4673-abe4-9b95b1d6bec0
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0a05c686d866/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments