Toy Ghouls’ New Toy: The GenieLocker Ransomware

    Friday, July 31, 2026 In: Threat Research Print

    Date: 07/31/2026

    Severity: High

    Summary

    GenieLocker is a cross-platform ransomware family designed to target Windows, Linux, and VMware ESXi environments, enabling attackers to encrypt endpoints, servers, and virtual machines in a single operation. The malware uses platform-specific capabilities to maximize impact, including encrypting virtual infrastructure and disrupting enterprise operations while employing techniques to evade analysis and detection.  It has been used in attacks against Russia. 

    Indicators of Compromise (IOC) List   

    IP ADdress

    89.125.66.101

    Hash

    18F61C6D686CFFD131C9FD3F3437064B

    25480DAD40152EF3D0C6D38EECC9BD9B

    34A7F28E0BB69B0D49BACC88BDF20AC1

    34B8828635F88078735799A3C1AC8E28

    3A4479B51890373BFC4A011EF41FE376

    58C0DDA52B8F069660166D61FD74F911

    5D62C1349B8981C396C9A23F4F8F053C

    780C8F4C6F077DA4DA96582987920362

    7DAD78584795AA5C160520CC6ACCF260

    824CA1E906CC073EE5B0F3519DF69A8F

    9201E35E2993612612919A3C71302CAB

    9969A8221312DBA70DD5CBDDF83A146C

    9CD514FF2809CE0B993E3B8649E82A94

    A50EAAF514F4F84E61CA2455A8789753

    A8842616C9057D5CF6E1FE1FA8C3C160

    B893EAFED0659F70D4AC250F09073723

    C68B6862725777651085650DB34947FC

    D3E06EB34D8EEE7EF92CAC3AD0A20FF5

    D661CF666B9ACBAB7CFEAE1127A261A9

    D87D0B01D95ACC936B7DC47B8F41937A

    DE3CFBB50F66079BFEE20A6F64E59433

    F08F476F26B01D142CA73923DE65FC0C

    F7B9E36E94163A9A303160945F99267A

    FD46A80C2F45577263328984EDF7F4DC

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    dstipaddress IN ("89.125.66.101") or srcipaddress IN ("89.125.66.101")

    Detection Query 2 :

    md5hash IN ("58C0DDA52B8F069660166D61FD74F911","D87D0B01D95ACC936B7DC47B8F41937A","9CD514FF2809CE0B993E3B8649E82A94","D661CF666B9ACBAB7CFEAE1127A261A9","3A4479B51890373BFC4A011EF41FE376","B893EAFED0659F70D4AC250F09073723","18F61C6D686CFFD131C9FD3F3437064B","9201E35E2993612612919A3C71302CAB","824CA1E906CC073EE5B0F3519DF69A8F","DE3CFBB50F66079BFEE20A6F64E59433","7DAD78584795AA5C160520CC6ACCF260","F08F476F26B01D142CA73923DE65FC0C","9969A8221312DBA70DD5CBDDF83A146C","34A7F28E0BB69B0D49BACC88BDF20AC1","A8842616C9057D5CF6E1FE1FA8C3C160","780C8F4C6F077DA4DA96582987920362","25480DAD40152EF3D0C6D38EECC9BD9B","5D62C1349B8981C396C9A23F4F8F053C","D3E06EB34D8EEE7EF92CAC3AD0A20FF5","FD46A80C2F45577263328984EDF7F4DC","34B8828635F88078735799A3C1AC8E28","F7B9E36E94163A9A303160945F99267A","A50EAAF514F4F84E61CA2455A8789753","C68B6862725777651085650DB34947FC")

    Reference: 

    https://securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/      


    Tags

    MalwareThreat ActorRansomwareRussia

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.