<< Back to Top Threats
K7 Detection Name Affected OS Prevalence AV Definition Version
Password-Stealer ( 005ca9da1 ) Windows Low 12.245.56247
MD5

05c5bdba1244815daee9205ddbcd42c9
SHA256

247e7ba782b30014bf1da7c5a69431cb1fc5329fc699f46013a6fd64d7694762
File Size

2,281,984 bytes
Packer Information

N/A
First Seen

02-07-2025
Last Seen

07-07-2026
Aliases

PSW.Agent.OP

Behavior Details

1. Creates Registry:
Adds data
pe64_amd64
under
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\BinaryType
Adds data
0000f519feec486de87ed73cb92d3cac802400000000
under
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\ProgramId
Adds data
0000ea8254338ff3811aa47061ed360c6dfe482aadaa
under
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\FileId
Adds data
microsoft corporation
under
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Publisher
Adds data
rundll32.exe|c8d854bf61fafc41
under
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\LongPathHash
Adds data
07/29/1998 17:20:24
under
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\LinkDate
Adds data
microsoft\xae windows\xae operating system
under
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\ProductName
Adds data
10.0.19041.5794
under
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\BinFileVersion
Adds data
\x9b\xe7\x9f\x02\x01(\x00\x80\x89u\xb2\x80\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x11\x04\xae\x02\x02\x00\x02\x00\xd8\xd4\xef\x94\x00\x00\x00\x00\x01\x00\x00\x00v\x02\x00\x00*n\xb2\x02\x01\x00\x00\x80\x94\xd0\x9e\xed\x00\x00\x00\x00\x02\x00\x00\x00`\x00\x00\x00y\x1a\xb6\x02\x01\x00\x03\x00\x8c\x8b\xe9\x96\x00\x00\x00\x00\x04\x00\x00\x00Q\x00\x00\x00\x13\xba\xeb\x02\x01\x01\x00\x80\x81\x82\x1a\xcb\x00\x00\x00\x00\x02\x00\x00\x00`\x00\x00\x00\x9e\x96\x03\x03\x01K\x00\x80\xc0\xf2\xcc\xa9\x00\x00\x00\x00\xf3\x00\x00\x00\x02\x00\x00\x00
under
HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\TIP\AggregateResults\data
Adds data
1
under
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\WritePermissionsCheck
Adds data
10.0.19041.5794 (winbuild.160101.0800)
under
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Version
Adds data
\x00^\x01\x00\x00\x00\x00\x00
under
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Size
Adds data
10.0.19041.5794
under
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\ProductVersion
Adds data
1033
under
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Language
Adds data
1
under
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\IsOsComponent
Adds data
c:\windows\system32\rundll32.exe
under
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\LowerCaseLongPath
Adds data
10.0.19041.5794
under
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\BinProductVersion
Adds data
rundll32.exe
under
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\OriginalFileName
Adds data
P\x88\xd2\x1e\x00\x00\x00\x00
under
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Usn
Adds data
rundll32.exe
under
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Name

Removal Instructions

1. Update K7 security to the latest version.
2. Open Windows registry editor and delete the following keys:
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\BinaryType
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\ProgramId
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\FileId
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Publisher
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\LongPathHash
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\LinkDate
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\ProductName
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\BinFileVersion
HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\TIP\AggregateResults\data
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\WritePermissionsCheck
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Version
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Size
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\ProductVersion
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Language
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\IsOsComponent
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\LowerCaseLongPath
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\BinProductVersion
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\OriginalFileName
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Usn
\REGISTRY\A\{1025e6f1-fd70-df56-07a2-18091fbd4af3}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Name
3. Restart the machine.