MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef591a22899653a15acd0c3f303d8659d7022df02681148891dcd153a8a5a317. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ef591a22899653a15acd0c3f303d8659d7022df02681148891dcd153a8a5a317
SHA3-384 hash:	bb4d0e35acd479b611f10fe73b16ebdf282b811c3d15992aca84f43ef608cbd2a3c682e8f6ce778e015b8b4c6ce47585
SHA1 hash:	9a36263e9e95812c8d756f6ac16c00e229483927
MD5 hash:	8f43e321dec9dd12d638776a36ee194e
humanhash:	india-lamp-diet-lamp
File name:	MuckModLoader Setup 2.1.1.exe
Download:	download sample
Signature	GenesisStealer Alert Create hunting rule
File size:	88'848'291 bytes
First seen:	2025-11-12 12:40:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (525 x GuLoader, 110 x RemcosRAT, 80 x EpsilonStealer)
ssdeep	1572864:jA+BWMFDe45kntGZ6hDRVOy1menoUu9Ma7vWZsYez153UubP7/5:jRBFle45yxhDRV7nohfvgo53UkPN
Threatray	716 similar samples on MalwareBazaar
TLSH	T11E18331C38E0CB5AC86EF97BE0731F1216A4704A2FC5775BB937AD8A64A8F51D730252
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	burger
Tags:	exe GenesisStealer stealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

111

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

MuckModLoaderSetup2.1.1.exe

Verdict:

Malicious activity

Analysis date:

2025-11-12 12:39:32 UTC

Tags:

evasion arch-doc discord stealer possible-phishing generic nodejs

Link:

https://app.any.run/tasks/57033601-71db-4fe1-9c12-141e15b014f0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6914800760ebe843fe8d59fe

Tags:

spawn sage blic

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Sending a custom TCP request

Creating a file in the %temp% subdirectories

Сreating synchronization primitives

Creating a window

Searching for the window

Searching for the Windows task manager window

Running batch commands

Creating a process with a hidden window

Launching a process

Using the Windows Management Instrumentation requests

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

adaptive-context anti-debug blackhole fingerprint installer installer installer-heuristic microsoft_visual_cc nsis overlay packed

Link:

https://www.filescan.io/uploads/6914807f33abde90e928a594/reports/2d894ea0-616a-4e6e-89f4-5f8d39b2704c/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/ef591a22899653a15acd0c3f303d8659d7022df02681148891dcd153a8a5a317

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-11-12T10:05:00Z UTC

Last seen:

2025-11-12T10:13:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-PSW.Script.Generic

Link:

https://opentip.kaspersky.com/ef591a22899653a15acd0c3f303d8659d7022df02681148891dcd153a8a5a317/results?tab=lookup

Joe Sandbox Genesis Stealer

Result

Threat name:

Genesis Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1812616

Signature

Adds a directory exclusion to Windows Defender

Attempt to bypass Chrome Application-Bound Encryption

Detected Genesis Stealer

Disables Windows Defender (via service or powershell)

Drops large PE files

Excessive usage of taskkill to terminate processes

Loading BitLocker PowerShell Module

Maps a DLL or memory area into another process

Modifies Windows Defender protection settings

Obfuscated command line found

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Queries sensitive system registry key value via command line tool

Sigma detected: Capture Wi-Fi password

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Potential Data Stealing Via Chromium Headless Debugging

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal WLAN passwords

Unusual module load detection (module proxying)

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

71%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/ef591a22899653a15acd0c3f303d8659d7022df02681148891dcd153a8a5a317

CERT.PL MWDB

Gathering data

Neiki Trojan-PSW.Script

Verdict:

Malicious

Threat:

Trojan-PSW.Script

Link:

https://tip.neiki.dev/file/ef591a22899653a15acd0c3f303d8659d7022df02681148891dcd153a8a5a317

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-11-12 12:39:35 UTC

File Type:

PE (Exe)

Extracted files:

5696

AV detection:

3 of 24 (12.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=55mruiujszj2cwwnbq7tapmglhlqelpqe2arjcer3tivhkffumlq._file

Threatray novablight

Verdict:

malicious

Label(s):

novablight

Alert

Create hunting rule

Similar samples:

1018ea2c424b9e706aa7aca835102856e2f3011b519aed2bfc4b4ddda6b34943

GenesisStealer

3eb1c65a9f04f1ff1a89fb333e3ecc6138f5a1556712e540ac31cf0a468290c4

GenesisStealer

4baa22a1681402b7535a378273f5032c645f32b5d673dae28fa5d386e4989990

GenesisStealer

5eda01fbeee3c05f216a595c97dc74343ce244d37d318101dc16fd6c3f9763a3

GenesisStealer

6d80b98eef771c5419e2e56634d93e9899bbb077f0ff6fbd6892ef775535bd65

GenesisStealer

7c5583fff213bd93237b110c274a7ceb8063dd7ee1d0b4fd38351e2975be5cee

GenesisStealer

80d082a75919d7bd43fa4d2ad5230ca85f10011bbb9d0a10a90a682cecfb79a1

GenesisStealer

88faf2ec9c45158188a6ef03e15e1f0f7d575a365d6bd9ea7e5cf49cb001e5e2

GenesisStealer

a971d86714a665b83073095cff2b848b8eba3edf7b9a4e3f121e5f76e7b0320a

GenesisStealer

deef7b287e2b5d2cc1e22366eedee09031fca511ab0741a341f40dc82ba74453

GenesisStealer

error

GenesisStealer

+ 706 additional samples on MalwareBazaar

Threat.Zone Malicious

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/fd718393-0bba-4fe8-8057-1180f39df615

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.