Malicious
Tier-1 engines including BitDefender, Emsisoft, and GData consensus on 'generickdq' trojan, with PowerShell evasion, direct IP contacts, Node.js stealer drops, and community 'Frost Stealer' confirmations.
07f008e9ebfb33b2ef…ebf70ed129The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
Multiple tier-1 engines agree on 'generickdq' with supporting detections from Kaspersky and ESET, fitting the principle for aggressive malicious lean on strong consensus. Behavioral evidence includes offensive MITRE techniques, direct IP C2 heuristic, and sandbox processes revealing evasion (console hiding) and compilation of suspicious code alongside Node.js stealer modules like sqlite3. Community comments provide strong corroboration naming specific stealer families. Unsigned status, negative reputation, and lack of counter-signals like trusted signing or clean RAG outweigh the few clean tier-1 reports and unknown children.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
tier1FamilyConsensus.generickdq strong=true (3 engines)
BitDefender tier1 QD:Trojan.GenericKDQ.A60F574F36
Kaspersky tier1 Trojan.Win64.Agentb.linc
triggeredHeuristics.MalwareTips.Synth.DirectIpC2 (IPs 34.160.111.145, 208.95.112.1)
communityComments Joe Sandbox 'Frost Stealer' Verdict MAL 100/100
- No malicious sandbox verdict
- No known malicious contacted hosts
- No malicious dropped children (all unknown)
- Tier-1 consensus on generickdq (3+ engines)
- Direct IP C2 (MalwareTips.Synth.DirectIpC2 heuristic)
- PowerShell execution policy bypass (T1059.001)
- Drops Node.js stealer modules (sqlite3, rustlersmgl)
- Unsigned with reputation -42
- Community stealer confirmations (Frost/Doenerium)
Delete or quarantine this file immediately to prevent potential credential theft. Run a full system scan and monitor for related Node.js processes or IP connections.
generickdq corroborated by 2 sources
- VT (76 engines)generickdq
- MT AI Enginegenerickdq
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 34.160.111.145
- 208.95.112.1
- 188.114.97.1
- 162.159.36.2
- http://ip-api.com/json/185.93.40.66
- C:\Users\<USER>\AppData\Local\Temp\pkg-H4xTna\f8483911f2c6e7e9681e7dce9a18106c512b21194c72c47fe3b52a10fa82555f
- C:\Users\<USER>\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\rustlersmgl\package.json
- C:\Users\<USER>\AppData\Local\Temp\pkg-H4xTna\762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c
- C:\Users\<USER>\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\rustlersmgl\lib\sqlite3-binding.js
- C:\Users\<USER>\AppData\Local\Temp\pkg-H4xTna\ffd2cd2c4f03854b361f7b2b4a46c86eedd274a29e74931f234d73466caa72f9
- C:\Users\<USER>\AppData\Local\Temp\ewhyo0yf\ewhyo0yf.cmdline
- C:\Users\<USER>\AppData\Local\Temp\ewhyo0yf\ewhyo0yf.err
- C:\Users\<USER>\AppData\Local\Temp\ewhyo0yf\ewhyo0yf.pdb
- C:\Users\<USER>\AppData\Local\Temp\ewhyo0yf\ewhyo0yf.out
- C:\Users\<USER>\AppData\Local\Temp\ewhyo0yf\ewhyo0yf.0.cs
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache.
- c4e9035c757d60acffae…208effNever scannednever seen before
- ddbc09f5b66fe24dd898…781e8bNever scannednever seen before
- cddbff7ca3aa570372a5…063595Never scannednever seen before
- e0bd9506b9ed500d57bd…2b24abNever scannednever seen before
- b1cb7da23cca1681c739…3442f3Never scannednever seen before
- 96ad1146eb96877eab59…87dcf7Never scannednever seen before
- 3e0b5e6d6f1a0c5ed106…ed0c65Never scannednever seen before
- ca9e67d562317863ac9a…15b389Never scannednever seen before
- befbda4868248093b1f5…35646dNever scannednever seen before
- 8a42b5b7846028921b2e…18ec6eNever scannednever seen before
YARA + heuristic rules that fired
One or more medium-severity heuristic rules matched. Not definitive, but the patterns match known malware behaviour.
Sample contacted 4 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence34.160.111.145 · 208.95.112.1 · 188.114.97.1
19 detections across 76 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Moderate prevalence — neither rare nor common. No strong prior applies.
Forensic fingerprint
- File name
- OutlastMods
- Size
- 91.28 MB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- 07f008e9ebfb33b2ef8a7f9dcf1f27bed1687359eb321044db47f9ebf70ed129
- MD5
- 547b2aaf0bf80f846e2f0c1ea166ed94
- SHA-1
- 682869d308b976aab3fa687385fe389676a8ff76
- PE imphash
- 9eba512b03d8cac8a6c4424e25e9f06e
- First seen (VT)
- 3/28/2026, 4:06:54 AM
- Last analysis (VT)
- 4/22/2026, 2:46:48 AM
- First scan (MalwareTips)
- 4/24/2026, 4:59:49 AM
- Last scan (MalwareTips)
- 4/24/2026, 4:59:49 AM
- Community reputation
- -42flagged
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.