MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 080d71eaff2082b9c10ff0a2414ed2371eb0eb700b71f975de595d7bbc409590. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	080d71eaff2082b9c10ff0a2414ed2371eb0eb700b71f975de595d7bbc409590
SHA3-384 hash:	de886602dcf41cae64f60c28041d4f3894d6e7ba15d7e2a04cf730e68654b9825f9e1e79d7c85ee9d00df36f80fc1dea
SHA1 hash:	d4e93e6e495bfa793d130a10b90051ed8094f87b
MD5 hash:	4b1a917019acb1e7f14ec8bdd2351ffa
humanhash:	lion-lamp-seventeen-hamper
File name:	Polyaris Setup-2.4.1.exe
Download:	download sample
Signature	GenesisStealer Alert Create hunting rule
File size:	88'636'951 bytes
First seen:	2026-03-24 12:33:50 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (563 x GuLoader, 120 x RemcosRAT, 82 x EpsilonStealer)
ssdeep	1572864:1s+BWMFDe45kChU6hDRVOs7PMqjJTlLMOJD2Z13nYcxWqQ0OQh+7oG:19BFle45zhfhDRV37RjLwSab3YFQ8H
Threatray	869 similar samples on MalwareBazaar
TLSH	T1AE1833277EE9FD5EC48A623E3BB1157928F4C4816BA7173F0202D4AEB57CAC15B12643
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	dec093c4f8d9d0e0 (1 x GenesisStealer)
Reporter	burger
Tags:	exe GenesisStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

320

Origin country :

NL

Vendor Threat Intelligence

ACCE NSIS_Installer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/4f220391-2094-4213-838b-8d47c6ecb8ff/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

PolyarisSetup-2.4.1.exe

Verdict:

Malicious activity

Analysis date:

2026-03-24 12:33:42 UTC

Tags:

evasion arch-doc anti-evasion ims-api generic stealer discord nodejs

Link:

https://app.any.run/tasks/52f635ff-1df7-4d52-9984-353e2b979214

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69c28469390b9964741342e9

Tags:

n/a

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% subdirectories

Сreating synchronization primitives

Searching for the window

Searching for the Windows task manager window

Running batch commands

Creating a process with a hidden window

Launching a process

Using the Windows Management Instrumentation requests

Creating a file

DNS request

Creating a file in the %AppData% subdirectories

Creating a process from a recently created file

Searching for synchronization primitives

Unauthorized injection to a recently created process

Loading a suspicious library

Connection attempt

Sending a custom TCP request

Moving a file to the %AppData% subdirectory

Launching a tool to kill processes

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

adaptive-context anti-debug blackhole crypto fingerprint installer installer installer-heuristic microsoft_visual_cc nsis packed soft-404

Link:

https://www.filescan.io/uploads/69c284db256cd88a6aae1bd5/reports/77f73153-ef48-413e-88ac-42a49c6eebbd/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/080d71eaff2082b9c10ff0a2414ed2371eb0eb700b71f975de595d7bbc409590

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

Detections:

HEUR:Trojan-PSW.Script.Generic

Link:

https://opentip.kaspersky.com/080d71eaff2082b9c10ff0a2414ed2371eb0eb700b71f975de595d7bbc409590/results?tab=lookup

Joe Sandbox Genesis Stealer

Result

Threat name:

Genesis Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

spyw.evad.troj

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1888231

Signature

Drops large PE files

Excessive usage of taskkill to terminate processes

Loading BitLocker PowerShell Module

Maps a DLL or memory area into another process

Obfuscated command line found

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Queries sensitive system registry key value via command line tool

Sigma detected: Capture Wi-Fi password

Suspicious powershell command line found

Tries to harvest and steal WLAN passwords

Unusual module load detection (module proxying)

Uses cmd line tools excessively to alter registry or file data

Uses ipconfig to lookup or modify the Windows network settings

Uses netsh to modify the Windows network and firewall settings

Uses WMIC command to query system information (often done to detect virtual machines)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

14%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/080d71eaff2082b9c10ff0a2414ed2371eb0eb700b71f975de595d7bbc409590

CERT.PL MWDB

Gathering data

Neiki Malicious

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/080d71eaff2082b9c10ff0a2414ed2371eb0eb700b71f975de595d7bbc409590

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bagxd2x7ecbltqip6crectwsg4plb23qbny7s5o6lfoxxpcaswia._file

Threatray novablight

Verdict:

malicious

Label(s):

novablight

Alert

Create hunting rule

Similar samples:

07531d80301a5a19ba1cd76e697a485a4e7d233a2edabf16953aa2b0975486cd

GenesisStealer

11de285d451f5f2f24fb449364ee836ea599fb0ed7863643aef43ccf888ecc26

GenesisStealer

1715bffc46bace588a5015bcc089fcad4d9905d6c7ed8a51c4d2ff970f3fe692

GenesisStealer

204b8a498705e97af6b7f050646bc3e9bb8609dc1cf8f57b5f7433e12b2e2319

GenesisStealer

33b01253db889904fe50103771ff248d6c836098917b20554cc5bce967be7c9b

GenesisStealer

401dec3bbc8bd4ce87cc0bb4ac8aedf6f40205b89476fb4b9ba9ebe0b135d459

GenesisStealer

4ba6866d613d0cbaaf6e586079b3de4ec0f951abb4ebd8c810ea86623242f186

GenesisStealer

86999ec14bdd085e1ec3acea4620d971369b928337f29169c941ffce276bf1c9

GenesisStealer

a4a882c22c248f95d2e913b5f83badcb0cd247894ee996ccbc15c575785e4788

GenesisStealer

d7a86dadc15ebf5cc064a9d9b413093854c25fdb6b06d3710300fcf4ffc79519

GenesisStealer

error

GenesisStealer

+ 859 additional samples on MalwareBazaar

Hatching Triage genesis_stealer

Result

Malware family:

genesis_stealer

Alert

Create hunting rule

Score:

  10/10

Tags:

family:genesis_stealer antivm credential_access defense_evasion discovery execution linux persistence privilege_escalation ransomware spyware stealer

Link:

https://tria.ge/reports/260324-pr4yjsgx2z/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Enumerates system info in registry

Gathers network information

Kills process with taskkill

Modifies data under HKEY_USERS

Modifies registry class

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Browser Information Discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

Program crash

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Wi-Fi Discovery

System Time Discovery

Drops file in Program Files directory

Drops file in Windows directory

Hide Artifacts: Ignore Process Interrupts

Enumerates processes with tasklist

Adds Run key to start application

Badlisted process makes network request

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Enumerates connected drives

Looks up external IP address via web service

Checks computer location settings

Drops startup file

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Modifies Windows Firewall

Uses browser remote debugging

Detects logs archive dumped by GenesisStealer

GenesisStealer

Genesis_stealer family

VMRay GenesisStealer

Malware family:

GenesisStealer

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/080d71eaff20/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.