home

KMSAuto Net.exe

KMSAuto Net

Ratiborus MSFree Inc.

Publisher:
MSFree Inc.  (signed by Ratiborus MSFree Inc.)

Product:
KMSAuto Net

Version:
1.3.8

MD5:
6ee7f3ecd5111cd5306792fd3141515d

SHA-1:
45c92d0e691175a39a8c61228f526f80a7ca94fc

SHA-256:
69a8ae6352cffd366409df8e566e84315b4bffcf5865a4b8079c446123ba1d26

Scanner detections:
5 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
12/26/2024 4:26:13 AM UTC  (today)

Scan engine
Detection
Engine version

Clam AntiVirus
Win.Tool.Kmsauto-2
0.98/23159

Dr.Web
Threat.Undefined
9.0.1.015

ESET NOD32
MSIL/HackKMS.I potentially unsafe application
6.3.12010.0

F-Secure
Riskware.Application.Hacktool.ME
5.15.154

Microsoft Security Essentials
HackTool:Win32/AutoKMS
1.237.536.0

File size:
6.7 MB (6,977,272 bytes)

Product version:
1.3.8

Original file name:
KMSAuto Net.exe

File type:
Executable application (Win64 EXE)

Language:
Language Neutral

Common path:
C:\ProgramData\kmsautos\kmsauto net.exe

Digital Signature
Signed by:
Ratiborus MSFree Inc.

Authority:
Ratiborus MSFree Inc.

Valid from:
7/26/2015 8:49:10 AM

Valid to:
1/1/2040 1:59:59 AM

Subject:
CN=Ratiborus MSFree Inc.

Issuer:
CN=Ratiborus MSFree Inc.

Serial number:
1EB52394D7A0F7804AC8F80D76139591

File PE Metadata
Compilation timestamp:
8/10/2015 9:45:14 AM

OS version:
4.0

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
80.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
196608:0eywBGqyw1lT3ywuywQyw1ywlywaywTyw9lywfywEyw1ywHywwywmIBywyywsywv:IwBGnw1l+wjwNw4wIw3w2w9IwqwJw4w4

Entry address:
0x69C4C2

Entry point:
4D, 5A, 90, 00, 03, 00, 00, 00, 04, 00, 00, 00, FF, FF, 00, 00, B8, 00, 00, 00, 00, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 80, 00, 00, 00, 0E, 1F, BA, 0E, 00, B4, 09, CD, 21, B8, 01, 4C, CD, 21, 54, 68, 69, 73, 20, 70, 72, 6F, 67, 72, 61, 6D, 20, 63, 61, 6E, 6E, 6F, 74, 20, 62, 65, 20, 72, 75, 6E, 20, 69, 6E, 20, 44, 4F, 53, 20, 6D, 6F, 64, 65, 2E, 0D, 0D, 0A, 24, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.0802

Code size:
6.6 MB (6,923,776 bytes)

The file KMSAuto Net.exe has been seen being distributed by the following 47 URLs.

https://doc-0k-a0-docs.googleusercontent.com/docs/securesc/19qfg940va726lmaiafbc73ttl1uvrap/5jkkmg87mod3i2pu7bmeoeogugbk3li0/1484964000000/.../00710035825566868175/0B9IjjFIkPfjTd29WN0tDeUIyckE?e=download

https://mega.nz/temporary/.../6NgAHCJI

http://img2.file-upload.cc:182/d/.../KMSAuto Net.exe

https://www.cielito.net/index.php/s/KcMRlza9Ks4IFXD/download?path=/.../KMSAuto Net 2015 v1.3.8 Portable&files=KMSAuto Net.exe

http://serv2.dailyuploads.net:182/d/.../KMSAuto_Net.exe

https://doc-0g-a8-docs.googleusercontent.com/docs/securesc/tnnoa737g2eo39a18rv6cghei9930nae/44jv146ed1vcduhlc0ebu7sebj1ehph9/1474142400000/01211232269831194343/.../0B5y_iZhCjBzMeHFVMzlVUmYtWDg?e=download

https://mega.nz/temporary/.../FgdxHJKR

https://userscloud.com/9pvpgjoav33e

https://doc-0g-04-docs.googleusercontent.com/docs/securesc/30tnmqn6hnjgl7iktki0q7g9k7uaaaa2/g90akualft81126rtjdoi5gp6te6idf4/1479808800000/.../11248953786539344683/0B-rjFmaOuyUhMWxOdzh1R1JtYlU?e=download

https://mega.nz/temporary/.../bkM0WDpZ

https://docs.google.com/uc?authuser=0&id=0BysHJeHw9qScYXp5bXl1bjY4elE&export=download

https://mg.mail.yahoo.com/.../download?m=YaDownload&mid=2_0_0_1_48798362_ACPFCmoAALBQVqijdghcoKoFej8&fid=Inbox&pid=2&clean=0&appid=YahooMailNeo&ymreqid=ae747a7d-e2dd-7fa8-01fb-720009010000

https://mega.nz/temporary/.../mc0kgIYL

https://doc-00-8o-docs.googleusercontent.com/docs/securesc/enjnirsjs48fsan0boba8jjdj72mqm1m/k3s1ush78h6s76vf7regki8ukdvgt9gb/1471384800000/10435255064622980538/.../0B2CYBXQX7e4sYXFCOERMdnNGVHM?e=download

https://doc-10-7g-docs.googleusercontent.com/docs/securesc/trucpqn3aj1q1v3ujia5aabar9r2o06n/m5i9or2dk1ikg3rjvvlhkv2fd76tnhtb/1472580000000/01211232269831194343/.../0B5y_iZhCjBzMeHFVMzlVUmYtWDg?e=download

https://docviewer.yandex.com/source?id=6vf6i-85nj9gujh0rr8wzle8n8nr4x020k4lbzflj0jqph34rmkl4ickff7g4ri9nv7nk408sz7634dmwzwdqlphpj7ryejl1qxktl49n&archive-path=//KMSAuto Net 2015 v1.3.8 Portable/.../fnrHtA3fstAex7fg==&name=Office 2016.rar

http://download.jajok.com/up/16/.../KMSAuto Net.exe

https://mega.nz/temporary/.../jABSQIAA

http://192.168.1.157:8091/cgi-bin/filemanager/.../KMSAuto Net.exe

https://doc-10-84-docs.googleusercontent.com/docs/securesc/mtdhbvpg87ouugekhgj055cqd21usv5h/7293r48skb6s8s00adu1o4i377v46gdb/1475956800000/.../17723528691698287038/0B5acKF4LgkeFUWQ2b0VTU3prc28?e=download

https://docs.google.com/uc?authuser=0&id=0ByNXx-q-Ge8LMFdjN2g4a2ZwakU&export=download

http://www.partage-facile.com/dl-view.php

ftp://asopo.es/PROGRAMAS/WINDOWS/OFFICE PROFFESIONAL PLUS 2016/Activadores/.../KMSAuto Net.exe

https://doc-0k-9s-docs.googleusercontent.com/docs/securesc/nfjermvd4o8dj912o8vfd7tdlu16eqas/553ih7ebct6enc0evqdqssgk169p1miu/1473436800000/01211232269831194343/.../0B5y_iZhCjBzMeHFVMzlVUmYtWDg?e=download

ftp://108.240.147.129/.../KMSAuto Net.exe

https://drive.google.com/uc?export=download&id=0BwgxTWMdMidyanNMeVFMejJ5emc

https://fs01n1.sendspace.com/dl/6ce9563b9a531a96cc613830023acc22/57c9923a7330e439/.../KMSAuto Net.exe

https://docviewer.yandex.com.tr/source?id=6vf6i-85nj9gujh0rr8wzle8n8nr4x020k4lbzflj0jqph34rmkl4ickff7g4ri9nv7nk408sz7634dmwzwdqlphpj7ryejl1qxktl49n&archive-path=//.../KMSAuto Net.exe&ts=155b6d94bfa&token=Qm reLfu595pE0iYGS1Ipw==&name=Office 2016.rar

https://doc-14-4k-docs.googleusercontent.com/docs/securesc/8s5frsoesllu4qtlljhm9e40npnjkrhe/kc7eo4bkceias6ua3l67b2apmrmf2lub/1463162400000/.../00827500290469144441/0B3JbDj7pCC4PSU5QQ3hiR3J6bk0?e=download

https://doc-0k-cc-docs.googleusercontent.com/docs/securesc/nsjgvl1ljunan67m7j8oncncocrjrrq2/06ssaclls79tnreqf937nnoonr9q5nkc/1472126400000/01211232269831194343/.../0B5y_iZhCjBzMeHFVMzlVUmYtWDg?e=download

Latest 30 of 47 download URLs

Scan KMSAuto Net.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.