home

kmspico_setup.exe

KMSpico

@ByELDI

The executable kmspico_setup.exe, “KMSpico Setup ” has been detected as malware by 18 anti-virus scanners. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from doc-04-8g-docs.googleusercontent.com and multiple other hosts.
Publisher:
@ByELDI  (signed and verified)

Product:
KMSpico

Description:
KMSpico Setup

Version:
9.3.1

MD5:
eed1a4af9d7080b2283bf50f551dde72

SHA-1:
671606c80aba8900233cf549247588d7dbb89c89

SHA-256:
38af4d0abb7d92a528bd05a3561dfe288cec9388b3ef6066b4af8e6ab91304d0

Scanner detections:
18 / 68

Status:
Malware

Analysis date:
12/3/2024 6:00:32 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.Generic.11447121
937

Avira AntiVirus
TR/Hijacker.Gen
7.11.135.226

AVG
Dropper.Msil
2015.0.3415

Bitdefender
Trojan.Generic.11447121
1.0.20.965

ESET NOD32
MSIL/HackTool.IdleKMS (variant)
8.10087

Fortinet FortiGate
Riskware/IdleKMS
7/12/2014

F-Secure
Trojan.Generic.11447121
11.2014-12-07_7

G Data
Trojan.Generic.11447121
14.7.24

IKARUS anti.virus
Trojan-Dropper.MSIL
t3scan.1.6.1.0

K7 AntiVirus
Hacktool
13.180.12701

McAfee
Artemis!EED1A4AF9D70
5600.7071

MicroWorld eScan
Trojan.Generic.11447121
15.0.0.579

NANO AntiVirus
Trojan.Win32.Hijacker.cuwkhc
0.28.0.59608

nProtect
Trojan.Generic.11044764
14.05.09.01

Panda Antivirus
Trj/CI.A
14.07.12.05

Trend Micro House Call
TROJ_GEN.F47V0302
7.2.193

Trend Micro
TROJ_GEN.R0CBC0OG214
10.465.12

VIPRE Antivirus
Trojan.Win32.Generic
29026

File size:
2.8 MB (2,930,552 bytes)

Product version:
9.3.1

Copyright:
ByELDI

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Digital Signature
Signed by:
@ByELDI

Authority:
@ByELDI Certificate Authority

Valid from:
6/22/2014 5:19:27 PM

Valid to:
6/22/2044 5:19:27 PM

Subject:
CN=@ByELDI

Issuer:
CN=@ByELDI Certificate Authority

Serial number:
4A35098748EDA459DCA4BD6658107C9A

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:M9n5vgPcA8qagPphBBhSZJV5+/PgAuzsafWP5Cnp1u2yNWMuwx0C309IESNN/qLo:G5v9A8fMByJMPcgafnn3unx55EZLlJKz

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file kmspico_setup.exe has been seen being distributed by the following 25 URLs.

https://doc-04-8g-docs.googleusercontent.com/docs/securesc/7luqlecfdfbt5kglkg2ppaan0cgk68nn/546fh12vh6smsldfhbd6t64b2h5bsamb/1478196000000/.../07692645574022727669/0B-p2bYUJlj8_dzlodm5jdXZRZXc?e=download

https://www.dropbox.com/sh/6upl7c55jinxn81/.../KMSpico_setup.exe

https://pmh0gq.bn1301.livefilestore.com/.../KMSpico.exe

https://dl-web.dropbox.com/get/Shared/.../KMSpico.exe

http://keys4nod.ru/KMSpico_setup.exe

https://docs.google.com/uc?authuser=0&id=0B7DmWq_AlOhvamZ2YTdLNjVVLVk&export=download

http://online.b1.org/rest/online/download/.../KMS.exe

https://p-par7.pcloud.com/.../KMSpico_setup.exe

https://mega.nz/persistent/.../SNki1Yrb

https://mega.nz/temporary/.../hMBDhaZY

https://doc-0k-1c-docs.googleusercontent.com/docs/securesc/q3frcl129kp4bk8v3ghdbqnq376lf2j4/m1ofljhmkab21o8cr8ill8g7e6q8aons/1440936000000/.../13513588452943219289/0B4YW1P0zggxFN3p6cGxfc3dIQVk?e=download

temp:KMS.exe

http://download1147.mediafire.com/c441e4g55mtg/.../KMSpico (v9.3.1.0).exe

https://doc-08-6s-docs.googleusercontent.com/docs/securesc/uthb8o88glpjjnpvhlmdlt7obhpqscok/qf7i25697fnuflarltfn5trob6aor4hk/1445270400000/.../10586494926827191758/0BwhvDrFgeSNfb1JLZ01peGs0aWM?e=download

temp:KMSpico_setup.exe

https://copy.com/web/companies/company-48874/users/user-13224199/apps/_utils/KMSpico_9.3.1_Final/.../KMSpico_setup.exe

https://doc-04-48-docs.googleusercontent.com/docs/securesc/hcsok1p865t7avmqs985gkckuspito2b/okqlup27f1g960n75en2gfc1jb7vt1bp/1419645600000/10520849603644735788/.../0B384m9CsBv4-cktIeG5MYU9faWs?e=download&h=07846633599055566674&nonce=4kshnu58pruou&user=12563982144160173782&hash=1f0vetkrqohgu6r4i1u954k3fkljpckv

https://docs.google.com/a/pnc.edu/nonceSigner?nonce=4kshnu58pruou&continue=https://doc-04-48-docs.googleusercontent.com/docs/securesc/hcsok1p865t7avmqs985gkckuspito2b/okqlup27f1g960n75en2gfc1jb7vt1bp/1419645600000/10520849603644735788/.../0B384m9CsBv4-cktIeG5MYU9faWs?e=download&h=07846633599055566674&hash=73gqgtjus2gkvk2glkbi86bf5iv11n58

https://doc-04-48-docs.googleusercontent.com/docs/securesc/hcsok1p865t7avmqs985gkckuspito2b/okqlup27f1g960n75en2gfc1jb7vt1bp/1419645600000/10520849603644735788/.../0B384m9CsBv4-cktIeG5MYU9faWs?h=07846633599055566674&e=download

https://docs.google.com/a/pnc.edu/uc?id=0B384m9CsBv4-cktIeG5MYU9faWs&export=download&urp=https://drive.google.com/a/pnc.edu/file/.../0B384m9C&pli=1

https://docs.google.com/a/pnc.edu/uc?id=0B384m9CsBv4-cktIeG5MYU9faWs&export=download&urp=https://drive.google.com/a/pnc.edu/file/.../0B384m9C&pli=1&auth=DQAAALUAAABGRdZuJLqxSeNiGZbwg7JoZCmstfud-vXkg1lpPwm49e__ilriLUpwNRL9eEa51Kv6dh2dax1NrKSiXbzRSOrvFwjxvkn5Ed4FwaYd5MlrgQnMa6YQEwCCkO1hoj-By0I29GIHk4uXzFVIkXam0efMHCQb8SwMZkFwF1M8QJR-kTuKQ_fAlRoyynLEmMnER6YP1bBmNjLwHYl3s2LTdoqGKfwusgbm8rK-KEGFwARBfILGr2gg6S8VKXCwJ8fHEiU&authuser=0

https://accounts.google.com/ServiceLogin?service=writely&passive=1209600&continue=https://docs.google.com/a/pnc.edu/uc?id=0B384m9CsBv4-cktIeG5MYU9faWs&export=download&urp=https://drive.google.com/a/pnc.edu/file/.../0B384m9C&followup=https://docs.google.com/a/pnc.edu/uc?id=0B384m9CsBv4-cktIeG5MYU9faWs&export=download&urp=https://drive.google.com/a/pnc.edu/file/.../0B384m9C&ltmpl=homepage&emr=1&authuser=0

https://www.google.com/accounts/ServiceLogin?service=writely&passive=1209600&continue=https://docs.google.com/a/pnc.edu/uc?id=0B384m9CsBv4-cktIeG5MYU9faWs&export=download&urp=https://drive.google.com/a/pnc.edu/file/.../0B384m9C&followup=https://docs.google.com/a/pnc.edu/uc?id=0B384m9CsBv4-cktIeG5MYU9faWs&export=download&urp=https://drive.google.com/a/pnc.edu/file/.../0B384m9C&ltmpl=homepage&emr=1&authuser=0

https://docs.google.com/a/.../uc?id=0B384m9CsBv4-cktIeG5MYU9faWs&export=download

https://docs.google.com/a/.../uc?authuser=0&id=0B384m9CsBv4-cktIeG5MYU9faWs&export=download

Remove kmspico_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.