MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d24dbda069525134f94904f7a16dbf275abcc0c8d7b0b9c065f39d91d3e2dd7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d24dbda069525134f94904f7a16dbf275abcc0c8d7b0b9c065f39d91d3e2dd7a
SHA3-384 hash:	e36b2326358e4fba8884ccc1e0864816317eaf426ac37008ee942e554dbdfafbdc30c5c08def1a8d9f5a8cb091e1d016
SHA1 hash:	8c2a397e0d7a1eae7793b0b06d40b175999de58c
MD5 hash:	09cf1fddb08051f5be72245b00638358
humanhash:	tennis-blossom-virginia-aspen
File name:	CyveraVPN Setup 2.1.1.exe
Download:	download sample
Signature	GenesisStealer Alert Create hunting rule
File size:	88'745'878 bytes
First seen:	2026-02-27 08:44:19 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (548 x GuLoader, 117 x RemcosRAT, 80 x EpsilonStealer)
ssdeep	1572864:L7+BWMFDe45kuObGJz6hDRz7PMqjJTlLMOJD2Z13nYcxWqQ0OQhw7lO2c:LCBFle45ZOjhDRz7RjLwSab3YFQmp6
TLSH	T12D1833577DD1FAABC04DB37A97F5F27414E989827F522B3B4202C59B71B8D842322982
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	burger
Tags:	exe GenesisStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

136

Origin country :

NL

Vendor Threat Intelligence

ACCE NSIS_Installer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/1aaa0446-f050-4317-b08a-cf691b2bfa16/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

CyveraVPNSetup2.1.1.exe

Verdict:

Malicious activity

Analysis date:

2026-02-27 08:44:52 UTC

Tags:

evasion anti-evasion generic stealer discord nodejs

Link:

https://app.any.run/tasks/f01377f6-0378-4857-9d4c-2fc5c90a804a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69a159b4c950ab5d9ab20952

Tags:

extens shell sage

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug blackhole fingerprint installer installer installer-heuristic microsoft_visual_cc nsis packed soft-404

Link:

https://www.filescan.io/uploads/69a159a9cd25bfe1dfdbc1b0/reports/a25c8261-0785-4a96-bcd8-4a15bca5ddb6/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/d24dbda069525134f94904f7a16dbf275abcc0c8d7b0b9c065f39d91d3e2dd7a

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

Detections:

HEUR:Trojan-PSW.Script.Generic

Link:

https://opentip.kaspersky.com/d24dbda069525134f94904f7a16dbf275abcc0c8d7b0b9c065f39d91d3e2dd7a/results?tab=lookup

Joe Sandbox Genesis Stealer

Result

Threat name:

Genesis Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

spyw.evad.troj

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1875825

Signature

Drops large PE files

Excessive usage of taskkill to terminate processes

Loading BitLocker PowerShell Module

Maps a DLL or memory area into another process

Obfuscated command line found

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive system registry key value via command line tool

Sigma detected: Capture Wi-Fi password

Suspicious powershell command line found

Tries to harvest and steal WLAN passwords

Unusual module load detection (module proxying)

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Uses WMIC command to query system information (often done to detect virtual machines)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

57%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/d24dbda069525134f94904f7a16dbf275abcc0c8d7b0b9c065f39d91d3e2dd7a

CERT.PL MWDB

Gathering data

Neiki Trojan-PSW.Script

Verdict:

Malicious

Threat:

Trojan-PSW.Script

Link:

https://tip.neiki.dev/file/d24dbda069525134f94904f7a16dbf275abcc0c8d7b0b9c065f39d91d3e2dd7a

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-02-27 08:44:03 UTC

File Type:

PE (Exe)

Extracted files:

5694

AV detection:

6 of 38 (15.79%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2jg33idjkjitj6kjat32c3n7e5nlzqgi26yltqdf6oozdu7c3v5a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

antivm credential_access defense_evasion discovery execution linux persistence privilege_escalation ransomware spyware stealer trojan

Link:

https://tria.ge/reports/260227-knz3zaav2f/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Enumerates system info in registry

Gathers network information

Kills process with taskkill

Modifies data under HKEY_USERS

Modifies registry class

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Browser Information Discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

Program crash

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Wi-Fi Discovery

System Time Discovery

Drops file in Windows directory

Hide Artifacts: Ignore Process Interrupts

Launches sc.exe

Enumerates processes with tasklist

Adds Run key to start application

Badlisted process makes network request

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Enumerates connected drives

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Disables one or more Microsoft Defender components

Modifies Windows Firewall

Uses browser remote debugging

Windows security bypass

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d24dbda06952/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.