MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ba6866d613d0cbaaf6e586079b3de4ec0f951abb4ebd8c810ea86623242f186. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4ba6866d613d0cbaaf6e586079b3de4ec0f951abb4ebd8c810ea86623242f186
SHA3-384 hash:	e83c60ce533ebeb4b8ae34a8fe0f1c9c516a3c8520de1535f97b9b814cee7ba8afce5b64bc4be9551f57c38f710c411b
SHA1 hash:	77c201da32574268b589b3b6291a16fe8f26f1ee
MD5 hash:	0abd523949818dcf3814de2fa08a6a58
humanhash:	vermont-oklahoma-mirror-bluebird
File name:	trackord v2.exe
Download:	download sample
Signature	GenesisStealer Alert Create hunting rule
File size:	88'000'171 bytes
First seen:	2026-01-07 18:10:17 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (563 x GuLoader, 120 x RemcosRAT, 82 x EpsilonStealer)
ssdeep	1572864:p6+BWMFDe45ke4J6hDRVOjGyD1KWHsPKhwC8coHhdXmaXALwpD/47Fb:prBFle45O8hDRVEBKQ5wvS4p2p
TLSH	T1681833BF1FD7880FC05635BF8AA526F154A668622D21E06F731A84BCA4ECE32D5345C7
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	28969696969696e8 (18 x GenesisStealer, 2 x MythStealer, 1 x QuasarRAT)
Reporter	burger
Tags:	exe GenesisStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

120

Origin country :

NL

Vendor Threat Intelligence

ACCE NSIS_Installer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/a5b06f3b-1a1e-4582-bd17-fdcea82c7f46/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

trackordv2.exe

Verdict:

Malicious activity

Analysis date:

2026-01-07 18:08:59 UTC

Tags:

evasion arch-doc anti-evasion discord stealer possible-phishing generic ims-api nodejs

Link:

https://app.any.run/tasks/ae330b23-ebc6-487d-8a6c-b3c1a4f8bf9a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Clean

Verdict:

Clean

Score:

89.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=695ea13b9922425f92fe6782

Tags:

n/a

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Сreating synchronization primitives

Creating a window

Searching for the window

Searching for the Windows task manager window

Running batch commands

Creating a process with a hidden window

Launching a process

Using the Windows Management Instrumentation requests

Creating a file

Creating a file in the %AppData% subdirectories

Creating a process from a recently created file

Searching for synchronization primitives

Unauthorized injection to a recently created process

Loading a suspicious library

Launching a tool to kill processes

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug blackhole fingerprint installer installer installer-heuristic microsoft_visual_cc nsis overlay packed

Link:

https://www.filescan.io/uploads/695ea19987e75cdd5af72b9e/reports/76461a74-b1d5-40f7-a234-9801fa82c4bd/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/4ba6866d613d0cbaaf6e586079b3de4ec0f951abb4ebd8c810ea86623242f186

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

exe x32

First seen:

2026-01-07T15:21:00Z UTC

Last seen:

2026-01-07T15:42:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/4ba6866d613d0cbaaf6e586079b3de4ec0f951abb4ebd8c810ea86623242f186/results?tab=lookup

Joe Sandbox Genesis Stealer

Result

Threat name:

Genesis Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1846237

Signature

Attempt to bypass Chrome Application-Bound Encryption

Detected Genesis Stealer

Drops large PE files

Excessive usage of taskkill to terminate processes

Loading BitLocker PowerShell Module

Maps a DLL or memory area into another process

Obfuscated command line found

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Queries sensitive system registry key value via command line tool

Sigma detected: Capture Wi-Fi password

Sigma detected: Potential Data Stealing Via Chromium Headless Debugging

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal WLAN passwords

Unusual module load detection (module proxying)

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

64%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/4ba6866d613d0cbaaf6e586079b3de4ec0f951abb4ebd8c810ea86623242f186

CERT.PL MWDB

Gathering data

Neiki Susipicious

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/4ba6866d613d0cbaaf6e586079b3de4ec0f951abb4ebd8c810ea86623242f186

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-01-07 18:08:56 UTC

File Type:

PE (Exe)

Extracted files:

5693

AV detection:

4 of 24 (16.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jotim3lbhuglvl3olbqhtm66j3apsunlwtv5rsaq5kdgemsc6gda._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

antivm credential_access defense_evasion discovery execution linux persistence privilege_escalation ransomware spyware stealer trojan

Link:

https://tria.ge/reports/260107-wsa57ae19a/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Enumerates system info in registry

Kills process with taskkill

Modifies data under HKEY_USERS

Modifies registry class

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Browser Information Discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Wi-Fi Discovery

System Time Discovery

Drops file in Windows directory

Hide Artifacts: Ignore Process Interrupts

Launches sc.exe

Enumerates processes with tasklist

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Disables one or more Microsoft Defender components

Uses browser remote debugging

Windows security bypass

Threat.Zone Malicious

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/dbbda752-f3d0-4e2d-99cd-b3bd9147bbf1

VMRay GenesisStealer

Malware family:

GenesisStealer

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/4ba6866d613d/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.64

Link:

https://yomi.yoroi.company/submissions/4ba6866d613d0cbaaf6e586079b3de4ec0f951abb4ebd8c810ea86623242f186