HackTool:Win32/AutoKMS!MSR (file analysis)

The HackTool:Win32/AutoKMS!MSR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What HackTool:Win32/AutoKMS!MSR virus can do?

A process created a hidden window
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine HackTool:Win32/AutoKMS!MSR?


File Info:
crc32: 6A959E13
md5: 39187da04b3fa0a78c9f09b7468974a0
name: 39187DA04B3FA0A78C9F09B7468974A0.mlw
sha1: dc7f1e613a54c174ce8cc309e6958499a0792c9d
sha256: a98995a2dcd323a8d5ebc1c6e4c831631ec3e80ffbe99e21262def517a904565
sha512: f56158836a5f99e9cb2a6d5d96a3e3b19e05fa04d75b60828d31d298fc8cfb0e41795d82f3839dbe8fa6f2b6528bafc9bf27455a517a3aa7d239488d7bbf8a26
ssdeep: 6144:E9+BzPb5i8CGJTWZ3qxpqqx502Dkw5PWqf2aLw7BQmgZ+N5229XhmKx9OTBQ4ir:w8FJSss7MW79tNNzL1jOT8UhBR
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0000 0x04b0

HackTool:Win32/AutoKMS!MSR also known as:

K7AntiVirus	Riskware ( 0040eff71 )
Lionic	Hacktool.Win32.KMSAuto.tpPy
Elastic	malicious (high confidence)
ALYac	Application.KMSTool.B
Cylance	Unsafe
Sangfor	Hacktool.Win32.KMSAuto.fb
BitDefender	Application.KMSTool.B
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.04b3fa
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HackTool.Win32.KMSAuto.fb
Alibaba	HackTool:Win32/KMSAuto.adb324ec
MicroWorld-eScan	Application.KMSTool.B
Tencent	Malware.Win32.Gencirc.1168f867
Ad-Aware	Application.KMSTool.B
Sophos	Generic PUA NM (PUA)
BitDefenderTheta	Gen:NN.ZexaF.34236.FuW@aWJAc!oi
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	HackTool.Win32.AutoKMS.AB
McAfee-GW-Edition	BehavesLike.Win32.Dropper.hh
FireEye	Generic.mg.39187da04b3fa0a7
Emsisoft	Application.KMSTool.B (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	HackTool.KMSAuto.dj
eGambit	Generic.Malware
Antiy-AVL	Trojan/Generic.ASMalwS.28252D4
Microsoft	HackTool:Win32/AutoKMS!MSR
GData	Application.KMSTool.B
TACHYON	Trojan/W32.KMSAuto.512512
AhnLab-V3	Unwanted/Win32.KMSAuto.C4033602
Acronis	suspicious
McAfee	RDN/Generic.dlj
MAX	malware (ai score=99)
VBA32	BScope.Trojan.Wacatac
TrendMicro-HouseCall	HackTool.Win32.AutoKMS.AB
Rising	Trojan.Generic@ML.96 (RDML:DtFZc9VYeMpafb0ynqRoHQ)
Yandex	Trojan.GenAsa!gvx5FIaRjQw
Ikarus	HackTool.Win32.AutoKMS
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	Riskware/KMSAuto
Paloalto	generic.ml

How to remove HackTool:Win32/AutoKMS!MSR?

HackTool:Win32/AutoKMS!MSR removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X