PUA

KMS Team (PUA) (file analysis)

Malware Removal

The KMS Team (PUA) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What KMS Team (PUA) virus can do?

  • Sample contains Overlay data
  • Presents an Authenticode digital signature
  • Reads data out of its own binary image
  • Authenticode signature is invalid

How to determine KMS Team (PUA)?


File Info:

name: EC5A88AE166BB05BA622.mlw
path: /opt/CAPEv2/storage/binaries/d05637078f5ae415b73c37fc209d87a15653a871dfb1360822e99e2a6cdc2a80
crc32: 47A25518
md5: ec5a88ae166bb05ba62252833e67e94c
sha1: d42a308c645bd093e93b15c30be5bb3be2adc4aa
sha256: d05637078f5ae415b73c37fc209d87a15653a871dfb1360822e99e2a6cdc2a80
sha512: 9eb3d54f78d6b9817dcd481dd890693586f4b52effb1c693e3adc0066fc5a6676ceffc875a7863200cdb052a90dc9ce84859769488d4b73cc7249d1ed46a5544
ssdeep: 49152:S5+hF16BFGVaiHowe8GSpg3IcLUwn0I5eF1c+gQJG3KeGjxC7F0GcY1A4eHwbNX7:S5aF12GVa4eo4Xm6qJUaxc7F057Q1
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T181F533856CA780F2C0A764715608B3025C76FE132F1966EBB7D43603AE376C9BB3E456
sha3_384: 2ea4cac3667dec5552c9183e9367483c7c0d45766dce364f61c947e2e7dc3e85c5c5a37096a106e4fae141452a7d75e6
ep_bytes: 558bec6aff6880fa410068f0c4410064
timestamp: 2016-04-02 22:14:34

Version Info:

CompanyName: Dropbox, Inc.
LegalCopyright: Dropbox, Inc.
ProductName: Dropbox
ProductVersion: 156.4.4909
FileDescription: Dropbox
Created: 7z SFX Constructor v4.5.0.0 (http://usbtor.ru/viewtopic.php?t=798)
Builder: Admin 02:30:20 03/10/2022
Translation: 0x0000 0x04b0

KMS Team (PUA) also known as:

BkavW32.AIDetect.malware2
AVGWin32:Evo-gen [Trj]
tehtrisGeneric.Malware
CylanceUnsafe
K7GWTrojan ( 005980a51 )
K7AntiVirusTrojan ( 005980a51 )
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/GenCBL.CPO
ClamAVWin.Malware.Drivepack-9884589-1
Trapminemalicious.high.ml.score
SophosKMS Team (PUA)
MicrosoftTrojan:Win32/Wacatac.B!ml
AvastWin32:Evo-gen [Trj]

How to remove KMS Team (PUA)?

KMS Team (PUA) removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment