Home / malware

PDF

PUA:Win32/KipodTools

First posted on 04 July 2016.
Source: Microsoft

Aliases :

There are no other names known for PUA:Win32/KipodTools.

Explanation :

Installation

This application can be downloaded from websites that offer third-party software downloads. For example, we have seen it downloaded from:

• download.cdn.savevid.com
• ec.ccm2.net
• download.cdn.jzip.com
• download16.cdn.jzip.com
• download18.cdn.jzip.com

We have seen this application use the following file names:

• iLividSetup.exe
• iLividSetup (1).exe
• TorchSetup.exe
• iLividSetupV1.exe
• iMesh_setup.exe
• BearShare_setup.exe
• ViberSetup.exe
• BandooV8.exe
• iLividSetup (2).exe

It can be digitally signed by the following vendors:

• AZTEC MEDIA INC.
• Bandoo Media Inc
• Bandoo Media, Inc
• Torch Media Inc.
• Musiclab, LLC

We have seen this application using product names such as:

• Data Manager
• SettingsManager
• iLivid
• SmdmF Service
• Torch

This application communicates with domains such as:

• preved.aztecbe.com
• preved.safetynutbe.com
• service.jzip.com
• download.cdn.jzip.com
• preved.bandoobe.com

For example:

• preved.aztecbe.com/login
• preved.aztecbe.com/login
• preved.aztecbe.com/login

Payload

Installs other programs

We have seen this application install other software on your PC. Some of these applications might be bundled during the installation process and not intended to be installed. We have seen it installing programs such as:

• Torch
• jZip
• Movies Search App for Internet Explorer (Dist. by Torch Media, Inc.)
• Music Search App for Chrome
• Movies Search App for Chrome
• Music Search App for Internet Explorer (Dist. by Bandoo Media, Inc.)

This description was published using automated analysis.

Last update 04 July 2016

 

TOP