MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b52ba67747f8eb8287080a41164972bfa79ad4ac1baf0966fbf54545faeed32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GenesisStealer


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b52ba67747f8eb8287080a41164972bfa79ad4ac1baf0966fbf54545faeed32
SHA3-384 hash: fbf6e6ff58c3a11ff07bee6e5a88c1e1bc3ae5c440062963d6225d0bcd5542efbdefb4cb9bf3883f07003db3159f6b74
SHA1 hash: 13484ac566fb6e205e1138a4a4c188249fc93da9
MD5 hash: 9f15f20fa261b9149b0510a5293ff3cc
humanhash: wolfram-quebec-lima-zebra
File name:JlgexjRD Setup 2.1.1.exe
Download: download sample
Signature GenesisStealer
Create hunting rule
File size:88'190'536 bytes
First seen:2026-03-24 12:33:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b34f154ec913d2d2c435cbd644e91687 (575 x GuLoader, 128 x RemcosRAT, 82 x EpsilonStealer)
ssdeep 1572864:Xa+BWMFDe45kTRkfm1V/6hDRof62qqIiJajSAA8OLVu9H02nk7rO2P:XLBFle45WCmShDRofGPiErAvVuq2k3J
TLSH T13918336BBE689C0AC47D333F67F539991E2622032DD4B2D215AD6DBF94F0B509520F82
TrID 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win64 Executable (generic) (6522/11/2)
8.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon e0e6a4f2d8ec79b1 (1 x GenesisStealer)
Reporter burger
Tags:exe GenesisStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
302
Origin country :
NL NL
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/076a3db1-68ab-4b5c-8444-5e464640972c/
Malware family:
n/a
ID:
1
File name:
JlgexjRDSetup2.1.1.exe
Verdict:
Malicious activity
Analysis date:
2026-03-24 12:33:21 UTC
Tags:
evasion arch-doc anti-evasion generic stealer nodejs discord
Link:
https://app.any.run/tasks/a727dd11-dd26-4f23-a582-ead9ba5a39f2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Clean
Score:
89.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69c28459aacb4c376b136eb8
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Creating a window
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Searching for the window
Searching for the Windows task manager window
Running batch commands
Creating a process with a hidden window
Launching a process
Using the Windows Management Instrumentation requests
Creating a file
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a tool to kill processes
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/4b52ba67747f8eb8287080a41164972bfa79ad4ac1baf0966fbf54545faeed32
Verdict:
Malicious
File Type:
exe x32
Detections:
HEUR:Trojan-PSW.Script.Generic
Link:
https://opentip.kaspersky.com/4b52ba67747f8eb8287080a41164972bfa79ad4ac1baf0966fbf54545faeed32/results?tab=lookup
Result
Threat name:
Genesis Stealer
Create hunting rule
Detection:
malicious
Classification:
spyw.evad.troj
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1888232
Signature
Drops large PE files
Excessive usage of taskkill to terminate processes
Loading BitLocker PowerShell Module
Maps a DLL or memory area into another process
Obfuscated command line found
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)
Queries sensitive system registry key value via command line tool
Sigma detected: Capture Wi-Fi password
Suspicious powershell command line found
Tries to harvest and steal WLAN passwords
Unusual module load detection (module proxying)
Uses cmd line tools excessively to alter registry or file data
Uses netsh to modify the Windows network and firewall settings
Uses WMIC command to query system information (often done to detect virtual machines)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1888232 Sample: JlgexjRD Setup 2.1.1.exe Startdate: 24/03/2026 Architecture: WINDOWS Score: 100 56 shed.dual-low.part-0012.t-0009.t-msedge.net 2->56 58 part-0012.t-0009.t-msedge.net 2->58 60 3 other IPs or domains 2->60 88 Sigma detected: Capture Wi-Fi password 2->88 90 Drops large PE files 2->90 8 JlgexjRD.exe 4 2->8         started        12 JlgexjRD.exe 2->12         started        14 JlgexjRD Setup 2.1.1.exe 12 430 2->14         started        signatures3 process4 dnsIp5 62 ip-api.com 208.95.112.1, 49698, 80 TUT-ASUS United States 8->62 92 Suspicious powershell command line found 8->92 94 Obfuscated command line found 8->94 96 Uses cmd line tools excessively to alter registry or file data 8->96 104 2 other signatures 8->104 17 cmd.exe 8->17         started        20 powershell.exe 8->20         started        22 cmd.exe 8->22         started        26 72 other processes 8->26 98 Tries to harvest and steal WLAN passwords 12->98 100 Unusual module load detection (module proxying) 12->100 102 Uses WMIC command to query system information (often done to detect virtual machines) 12->102 48 C:\Users\user\AppData\Local\...\JlgexjRD.exe, PE32+ 14->48 dropped 50 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 14->50 dropped 52 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 14->52 dropped 54 17 other files (none is malicious) 14->54 dropped 24 cmd.exe 1 14->24         started        file6 signatures7 process8 dnsIp9 66 Uses cmd line tools excessively to alter registry or file data 17->66 68 Uses netsh to modify the Windows network and firewall settings 17->68 70 Tries to harvest and steal WLAN passwords 17->70 29 conhost.exe 17->29         started        31 chcp.com 17->31         started        72 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 20->72 74 Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes) 20->74 76 Queries memory information (via WMI often done to detect virtual machines) 20->76 33 conhost.exe 20->33         started        78 Queries sensitive system registry key value via command line tool 22->78 44 2 other processes 22->44 35 conhost.exe 24->35         started        37 tasklist.exe 1 24->37         started        39 find.exe 1 24->39         started        64 chrome.cloudflare-dns.com 162.159.61.3, 443, 49699 CLOUDFLARENETUS United States 26->64 80 Excessive usage of taskkill to terminate processes 26->80 82 Maps a DLL or memory area into another process 26->82 84 Uses WMIC command to query system information (often done to detect virtual machines) 26->84 86 Loading BitLocker PowerShell Module 26->86 41 powershell.exe 26->41         started        46 83 other processes 26->46 signatures10 process11 signatures12 106 Loading BitLocker PowerShell Module 41->106
Score:
60%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/4b52ba67747f8eb8287080a41164972bfa79ad4ac1baf0966fbf54545faeed32
Gathering data
Verdict:
Susipicious
Link:
https://tip.neiki.dev/file/4b52ba67747f8eb8287080a41164972bfa79ad4ac1baf0966fbf54545faeed32
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jnjluz3up6hlqkdqqcsbczexfp5htlkkyg5pbftpx5kfix5o5uza._file
Result
Malware family:
genesis_stealer
Create hunting rule
Score:
  10/10
Tags:
family:genesis_stealer antivm credential_access defense_evasion discovery execution linux persistence privilege_escalation ransomware spyware stealer trojan
Link:
https://tria.ge/reports/260324-pr2s7agx2w/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Gathers network information
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies registry class
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Wi-Fi Discovery
System Time Discovery
Drops file in Windows directory
Hide Artifacts: Ignore Process Interrupts
Enumerates processes with tasklist
Checks installed software on the system
Contacts third-party web service commonly abused for C2
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Modifies Windows Firewall
Uses browser remote debugging
Detects logs archive dumped by GenesisStealer
GenesisStealer
Genesis_stealer family
Malware family:
GenesisStealer
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4b52ba67747f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments