Malicious
Tier-1 engines including BitDefender, Emsisoft, and GData consensus on 'generickdq' trojan, with PowerShell evasion, direct IP contacts, Node.js stealer drops, and community 'Frost Stealer' confirmations.
07f008e9ebfb33b2ef…ebf70ed129The reasoning behind this verdict
The MT AI Engine weighs every signal from this scan — antivirus detections, sandbox behaviour, code signing, prevalence and historical matches — to reach a single, evidence-based verdict.
Multiple tier-1 engines agree on 'generickdq' with supporting detections from Kaspersky and ESET, fitting the principle for aggressive malicious lean on strong consensus. Behavioral evidence includes offensive MITRE techniques, direct IP C2 heuristic, and sandbox processes revealing evasion (console hiding) and compilation of suspicious code alongside Node.js stealer modules like sqlite3. Community comments provide strong corroboration naming specific stealer families. Unsigned status, negative reputation, and lack of counter-signals like trusted signing or clean RAG outweigh the few clean tier-1 reports and unknown children.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
tier1FamilyConsensus.generickdq strong=true (3 engines)
BitDefender tier1 QD:Trojan.GenericKDQ.A60F574F36
Kaspersky tier1 Trojan.Win64.Agentb.linc
triggeredHeuristics.MalwareTips.Synth.DirectIpC2 (IPs 34.160.111.145, 208.95.112.1)
communityComments Joe Sandbox 'Frost Stealer' Verdict MAL 100/100
- No malicious sandbox verdict
- No known malicious contacted hosts
- No malicious dropped children (all unknown)
- Tier-1 consensus on generickdq (3+ engines)
- Direct IP C2 (MalwareTips.Synth.DirectIpC2 heuristic)
- PowerShell execution policy bypass (T1059.001)
- Drops Node.js stealer modules (sqlite3, rustlersmgl)
- Unsigned with reputation -42
- Community stealer confirmations (Frost/Doenerium)
Delete or quarantine this file immediately to prevent potential credential theft. Run a full system scan and monitor for related Node.js processes or IP connections.
What this file does
What it attempted when executed in an isolated sandbox
High concern: Talks to a remote server to take commands or send out your data.
High concern: Encrypts your files and demands payment — ransomware behaviour.
Moderate concern: Obfuscates or packs its code to avoid detection.
Moderate concern: Runs hidden system commands (script or shell).
Moderate concern: Deletes traces of itself to cover its tracks.
Note: Collects details about your system.
Translated from the file's technical behaviour during analysis. It never ran on your device.
Threat context
How info-stealers work
An info-stealer runs quietly in the background and copies your private data — saved passwords, browser cookies, autofill details, and crypto wallets — then sends it to criminals. You usually won't notice anything is wrong.
Bottom line:Stolen logins are used to break into your accounts or sold in bulk on criminal markets.
What to do now
This file is dangerous. Treat it as harmful and remove it.
Don't open or run this file. Delete it from your Downloads (or wherever you saved it), then empty the Recycle Bin.
If you already opened it, disconnect from the internet and run a full scan with your antivirus — Windows Security, built into Windows, is sufficient.
If any of your files were locked or renamed, do NOT pay the ransom — payment rarely restores files. Recover them from a backup instead.
In future, only download software from the official website or an official app store.
generickdq corroborated by 2 sources
- VT (76 engines)generickdq
- MT AI Enginegenerickdq
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 34.160.111.145
- 208.95.112.1
- 188.114.97.1
- 162.159.36.2
- http://ip-api.com/json/185.93.40.66
- C:\Users\<USER>\AppData\Local\Temp\pkg-H4xTna\f8483911f2c6e7e9681e7dce9a18106c512b21194c72c47fe3b52a10fa82555f
- C:\Users\<USER>\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\rustlersmgl\package.json
- C:\Users\<USER>\AppData\Local\Temp\pkg-H4xTna\762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c
- C:\Users\<USER>\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\rustlersmgl\lib\sqlite3-binding.js
- C:\Users\<USER>\AppData\Local\Temp\pkg-H4xTna\ffd2cd2c4f03854b361f7b2b4a46c86eedd274a29e74931f234d73466caa72f9
- C:\Users\<USER>\AppData\Local\Temp\ewhyo0yf\ewhyo0yf.cmdline
- C:\Users\<USER>\AppData\Local\Temp\ewhyo0yf\ewhyo0yf.err
- C:\Users\<USER>\AppData\Local\Temp\ewhyo0yf\ewhyo0yf.pdb
- C:\Users\<USER>\AppData\Local\Temp\ewhyo0yf\ewhyo0yf.out
- C:\Users\<USER>\AppData\Local\Temp\ewhyo0yf\ewhyo0yf.0.cs
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache.
- c4e9035c757d60acffae…208effNever scannednever seen before
- ddbc09f5b66fe24dd898…781e8bNever scannednever seen before
- cddbff7ca3aa570372a5…063595Never scannednever seen before
- e0bd9506b9ed500d57bd…2b24abNever scannednever seen before
- b1cb7da23cca1681c739…3442f3Never scannednever seen before
- 96ad1146eb96877eab59…87dcf7Never scannednever seen before
- 3e0b5e6d6f1a0c5ed106…ed0c65Never scannednever seen before
- ca9e67d562317863ac9a…15b389Never scannednever seen before
- befbda4868248093b1f5…35646dNever scannednever seen before
- 8a42b5b7846028921b2e…18ec6eNever scannednever seen before
YARA & heuristic rule matches
One or more medium-severity heuristic rules matched. Not definitive, but the patterns match known malware behaviour.
Sample contacted 4 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence34.160.111.145 · 208.95.112.1 · 188.114.97.1
19 detections across 76 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Forensic fingerprint
- File name
- OutlastMods
- Size
- 91.28 MB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- 07f008e9ebfb33b2ef8a7f9dcf1f27bed1687359eb321044db47f9ebf70ed129
- MD5
- 547b2aaf0bf80f846e2f0c1ea166ed94
- SHA-1
- 682869d308b976aab3fa687385fe389676a8ff76
- PE imphash
- 9eba512b03d8cac8a6c4424e25e9f06e
- First seen (VT)
- 3/28/2026, 4:06:54 AM
- Last analysis (VT)
- 4/22/2026, 2:46:48 AM
- First scan (MalwareTips)
- 4/24/2026, 4:59:49 AM
- Last scan (MalwareTips)
- 4/24/2026, 4:59:49 AM
- Community reputation
- -42flagged
Safety FAQ
Common questions about OutlastMods, answered from the scan data above.
- Yes — OutlastMods is malicious, so do not opened it, and delete it. 19 of 76 antivirus engines flag it (family: generickdq). It behaves as an information stealer/spyware, built to harvest passwords, cookies, and wallet data. If you've already opened it, see the removal and recovery steps below.
- OutlastMods is a file, about 91.3 MB. Our analysis identifies it as malicious (family: generickdq) — an information stealer/spyware, built to harvest passwords, cookies, and wallet data. Because a file's name and icon can be faked, the safest way to identify it is by its cryptographic hash (below), not its filename.
- 19 of 76 antivirus engines flagged OutlastMods, 19 of them as outright malicious. A detection rate at this level is a reliable signal that the file is dangerous.
- Act quickly. 1) Disconnect the device from the internet to stop the malware communicating or spreading. 2) Run a full scan with reputable anti-malware software (such as Malwarebytes) and quarantine everything it finds. 3) Change your important passwords from a DIFFERENT, clean device — many threats log keystrokes or steal saved credentials. 4) If you bank or shop on this device, watch closely for fraud and alert your bank. 5) For a confirmed infection, the most reliable fix is to back up your personal files and reinstall the operating system for a clean start.
- To remove OutlastMods: 1) restart into Safe Mode (Safe Mode with Networking if you need to download a tool) so the malware doesn't auto-start. 2) Run a full scan with reputable anti-malware software and let it quarantine or delete the detections. 3) Delete the original OutlastMods file and empty the Recycle Bin/Trash. 4) Check your browser extensions, startup items, and scheduled tasks for anything unfamiliar. 5) Reboot and scan again to confirm it's gone. If detections keep coming back, a clean operating-system reinstall is the most dependable cure.
- OutlastMods is classified as an information stealer/spyware, built to harvest passwords, cookies, and wallet data. Engines attribute it to the generickdq family. Knowing the family matters because it tells you the likely impact — data theft, remote control, file encryption, or unwanted ads — and guides the cleanup.
- The SHA-256 hash of OutlastMods is 07f008e9ebfb33b2ef8a7f9dcf1f27bed1687359eb321044db47f9ebf70ed129, and its MD5 is 547b2aaf0bf80f846e2f0c1ea166ed94. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.
- This report reflects the scan run on April 24, 2026. Because a file's hash never changes, the identity of OutlastMods is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.