Geni

Overview

Trojan:Win32/Geni (often a truncation of 'Generic') signifies that the antivirus engine has blocked a file not based on a specific, known signature, but because its behavior, structure, or origin heavily aligns with malicious patterns (`T1105`). This often indicates a newly compiled malware variant (zero-day), a heavily obfuscated dropper, or a polymorphic threat designed specifically to evade traditional static analysis.

Understanding Generic/Heuristic Detections
To an end-user, the experience is the same as a known malware block—the file is quarantined. For a SOC analyst, a 'Geni' alert demands investigation. Because the AV doesn't know *what* family the malware belongs to, the analyst must determine the malware's ultimate intent (e.g., was it trying to drop ransomware, steal credentials, or join a botnet?).

Execution and Behavioral Indicators
Generic detections are often triggered when a file attempts highly suspicious actions upon execution. These include attempting to inject code into legitimate processes like `explorer.exe` or `svchost.exe` (`T1055`), trying to write to protected registry keys (like Run keys for persistence) (`T1547.001`), or unpacking itself in memory and making immediate, anomalous outbound network connections (`T1027.002`). The AV engine observes this chain of events and terminates the process heuristically.

Indicators of Compromise (IoCs)
IoCs for generic detections are inherently behavioral rather than static. Security teams must rely on EDR telemetry to reconstruct the process tree. Look for the initial vector (e.g., an Office document spawning PowerShell or a command prompt) leading to the execution of the flagged executable. Network IoCs involve identifying the C2 infrastructure the malware attempted to contact before it was terminated. The file hash itself is an IoC, but may be unique to this specific attack (polymorphic).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_GENI_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Geni"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "geni" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Geni (Ransomware) Execution & Triage
id: 0264be26-0f81-54cc-b0d5-fadcb3cc14a1
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Geni malware family. Detects volume shadow copy deletion, boot status tampering,
  and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/geni
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1055
- attack.t1105
- attack.t1027_002
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_GENI_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Geni tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "geni" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Ensure the endpoint remains isolated until the true nature of the 'Geni' threat is determined.
2. Retrieve the quarantined file and submit it to a malware sandbox (e.g., Cuckoo, Any.Run) for dynamic behavioral analysis.
3. Use EDR to trace back the origin of the file (e.g., did it arrive via email, a web download, or dropped by another process?).
4. Hunt for the identified file hash and any associated C2 domains across the rest of the enterprise network.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume a generic detection is a false positive without verifying the file's behavior; attackers constantly repack malware to trigger these generic alerts instead of specific ones.
2. Avoid whitelisting the file based solely on user request without performing a thorough behavioral analysis.

References & External Analysis

• Search "geni" on VirusTotal (External Analysis)
• Search "geni" on Any.Run (Sandbox Sandbox)
• Search "geni" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Ruandmel
• Uruasy
• Filefinder
• Genericrxbu
• Suviapen
• Krunchy
• Fotopapps
• Quchispy

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/geni.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.