home

down.luckytool.net

yssoft

Domain Information

The domain down.luckytool.net registered by yssoft was initially registered in August of 2014 through GABIA, INC.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Seoul, Seoul-T'Ukpyolsi within Korea which resides on the Asia Pacific Network Information Centre network.
Registrar:
GABIA, INC.

Server location:
Seoul-T'Ukpyolsi, Korea (KR)

Create date:
Thursday, August 28, 2014

Expires date:
Monday, August 28, 2017

Updated date:
Thursday, December 11, 2014

ASN:
AS9318 HANARO-AS Hanaro Telecom Inc.,KR

Root domain:
luckytool.net

Whois:
1 luckytool.net record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.jncmarketinginc, PUP.jncmarketinginc (M), PUP.Wetelecommunication (M), PUP.yssoft (M), PUP.yssoft.Installer (M)
98.00%

ESET NOD32
Win32/Adware.Kraddare.GC (variant), Win32/Adware.SafeTerra (variant), Win32/Adware.PopAd.AH (variant)
12.00%

AVG
Generic5
12.00%

Trend Micro House Call
Suspicious_GEN.F47V0407, Suspicious_GEN.F47V0521, TROJ_GEN.R0E9H09CV15, ADW_KRADDARE, Suspicious_GEN.F47V1108
10.00%

AhnLab V3 Security
PUP/Win32.SubShop
10.00%

McAfee
Artemis!2647BEBC9252, Artemis!39D788CE0E9F, Artemis!B66B571708DE, Artemis!F8B47D180C6B
10.00%

Emsisoft Anti-Malware
Adware.Win32.Kraddare, Adware.Kraddare.FO
10.00%

VIPRE Antivirus
Trojan.Win32.Generic, Adware.Agent
8.00%

ViRobot
Adware.DreamPrime.898096, Adware.DreamPrime.2206704, Adware.DreamPrime.2228208
8.00%

Malwarebytes
Adware.Korad
8.00%

Baidu Antivirus
Adware.Win32.Kraddare, Adware.Win32.SafeTerra, Adware.Win32.PopAd
8.00%

Bkav FE
W32.HfsAdware
8.00%

Dr.Web
Trojan.Adkor.91, Trojan.Click3.9707
8.00%

Qihoo 360 Security
Win32/Trojan.Adware.7a7, HEUR/QVM10.1.Malware.Gen
6.00%

MicroWorld eScan
Adware.Kraddare.FO
6.00%

The domain down.luckytool.net has been seen to resolve to the following IP address.

116.127.121.26
February 29, 2016

File downloads found at URLs served by down.luckytool.net.

1 / 68      (PUP)
http://down.luckytool.net/.../luckytoola.exe  (954453908d7082905b08b0b42db4a40a)

1 / 68      (PUP)
http://down.luckytool.net/.../luckytoolb.exe  (9f7dd186678a194d4ef220058d595888)

1 / 68      (PUP)
http://down.luckytool.net/.../luckytoolc.exe  (efc8bdb28f03cb4be2ebaf24860d58b4)

1 / 68      (PUP)
http://down.luckytool.net/.../caribooa.exe  (669004b2e837e042e1b166fb27d68717)

1 / 68      (PUP)
http://down.luckytool.net/.../cariboob.exe  (0f543edf97857c0fa07ac73ba3705e91)

1 / 68      (PUP)
http://down.luckytool.net/.../caribooc.exe  (ee08a0afa4b9719cdb41bcaa65ddb240)

1 / 68      (PUP)
http://down.luckytool.net/.../roryoka.exe  (be4325d06104cae3433b7aeb1bbcb6fa)

1 / 68      (PUP)
http://down.luckytool.net/.../roryokb.exe  (436b051e8b0aab530826f60f789a6ed9)

1 / 68      (PUP)
http://down.luckytool.net/.../roryokc.exe  (7451e397aadc18979d219e6d0c953331)

1 / 68      (PUP)
http://down.luckytool.net/.../salmana.exe  (269717587d2d9a7d4feb7bc03808b192)

1 / 68      (PUP)
http://down.luckytool.net/.../salmanb.exe  (573dfbdaed8bb25727459a017f87d12f)

1 / 68      (PUP)
http://down.luckytool.net/.../salmanc.exe  (6259fb958c868dcf63b63807c924cc41)

14 / 68    (Adware)
http://down.luckytool.net/clickpop/.../ClickpopLib.dll  (80f8ad6aecc17ca417ed8a6e23121331)

7 / 68      (PUP)
http://down.luckytool.net/yestop/.../Yestoplib.dll  (d1422f43c548578ef175bb0254b0894e)

1 / 68      (PUP)
http://down.luckytool.net/pop/.../subpop.dll  (a8848c64f12f20250eff1e644f69c8b5)

1 / 68      (PUP)
http://down.luckytool.net/pop/.../wingad.dll  (98bed9bfa17c61b631b595e72405b6c3)

1 / 68      (PUP)
http://down.luckytool.net/.../oldosera.exe  (2eb58a580b9328c8e4bdab3bbe855083)

1 / 68      (PUP)
http://down.luckytool.net/.../oldoserb.exe  (5399c14cb30637cc566296a5cf2fa32a)

1 / 68      (PUP)
http://down.luckytool.net/.../oldoserc.exe  (f2ce10187409e1d32c880f942377a0ac)

1 / 68      (PUP)
http://down.luckytool.net/.../oldfreda.exe  (99c4ed48a89c2875275cdcec6c232fb8)

1 / 68      (PUP)
http://down.luckytool.net/.../oldfredb.exe  (ab78505cc52c7678093b12daa99e5373)

1 / 68      (PUP)
http://down.luckytool.net/.../oldfredc.exe  (767f3b318e5d21712128c067309a17e9)

1 / 68      (PUP)
http://down.luckytool.net/.../luckyinstall.exe  (1a0dea99b6f3a7f27507e2a5c030c1c0)

1 / 68      (PUP)
http://down.luckytool.net/.../purwaa.exe  (e8b99d3031def3537e29b4c4da5364e6)

1 / 68      (PUP)
http://down.luckytool.net/.../purwab.exe  (202e57119b6c428902c441fc6bdd4fa3)

1 / 68      (PUP)
http://down.luckytool.net/.../purwac.exe  (534359834bfc3c82e4ec11bd7c1fe3a1)

1 / 68      (PUP)
http://down.luckytool.net/.../trippa.exe  (408d473ed5180a53acaeb6c814a36313)

1 / 68      (PUP)
http://down.luckytool.net/.../trippb.exe  (01f30f837d9b3c6d54a9f5978e5d1905)

1 / 68      (PUP)
http://down.luckytool.net/.../trippc.exe  (a7610ae2418952f5937cc5055ee5390e)

1 / 68      (PUP)
http://down.luckytool.net/.../ruddha.exe  (55fb6a57288ad50b0489faebd1b48043)

 
Latest 30 of 87 download URLs

URL:
http://down.luckytool.net/

Web server:
Apache

subshop.net

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.