Home / malware

PDF

PUA:Win32/AutoKMS

First posted on 15 February 2019.
Source: Microsoft

Aliases :

PUA:Win32/AutoKMS is also known as not-a-virus:NetTool.Win64.RPCHook.a, Generic KeyGen, a variant of Win32/HackTool.KMSAuto.E potentially unsafe app, Troj/Keygen-FU, CRCK_KMS, Application.Hacktool.ME, Hacktool.

Explanation :

Installation

This application can be downloaded from websites that offer third-party software downloads. For example, we have seen it downloaded from:

aabbc3df-a-62cb3a1a-s-sites.googlegroups.com cafeattach.naver.net doc-0g-7s-docs.googleusercontent.com download027.fshare.vn download029.fshare.vn

We have seen this application use the following file names:

AutoPico.exe KMSAuto.exe KMSAuto Net.exe KMSpico_setup.exe Service_KMS.exe Re-LoaderByR@1n.exe KMSpico_10.2.0.san.rar www.ratondownloads.com.br AT2016.rar Re-Loader RATON.exe

It can be digitally signed by the following vendors:

@ByELDI Ratiborus MSFree Inc. WZT ByELDI Certificate diakov.net

We have seen this application using product names such as:

Service_KMS AutoPico KMS GUI ELDI Re-Loader By R@1n KMSAuto Net

This application communicates with domains such as:

freeupgradesoftpro2016.xyz myalchemy.altervista.org users9.nofeehost.com reseller.ijabry.com www.nsaneforums.com

For example:

freeupgradesoftpro2016.xyz/freeupgradesoftNEW/6-Office2016Trial/Version.txt freeupgradesoftpro2016.xyz/freeupgradesoftNEW/6-Office2016Trial/Version.txt freeupgradesoftpro2016.xyz/freeupgradesoftNEW/8-Windows10PHONE/Version.txt Payload

Exhibits suspicious behaviors

We have observed this application exhibit the following potentially unwanted behavior on PCs:

Installs programs that start automatically when your PC starts

Installs other programs

We have seen this application install other software on your PC. Some of these applications might be bundled during the installation process and not intended to be installed. We have seen it installing programs such as:

Windows 10 Pro Permanent Activator v1.1 KMSpico

This description was published using automated analysis.

Last update 15 February 2019

 

TOP