home

a.kindscanmeta.com

Moti Tekan

Domain Information

The domain a.kindscanmeta.com registered by Moti Tekan was initially registered in March of 2015 through TLD REGISTRAR SOLUTIONS LTD. Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
TLD REGISTRAR SOLUTIONS LTD

Server location:
Oregon, United States (US)

Create date:
Sunday, March 22, 2015

Expires date:
Tuesday, March 22, 2016

Updated date:
Tuesday, March 24, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
kindscanmeta.com

Whois:
1 kindscanmeta.com record

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP
100.00%

Emsisoft Anti-Malware
Gen:Variant.Adware.Mplug.46
16.67%

F-Secure
Gen:Variant.Adware.Mplug
16.67%

Dr.Web
Trojan.Crossrider1.33816
16.67%

Lavasoft Ad-Aware
Gen:Variant.Adware.Mplug.46
16.67%

McAfee
Program.MultiPlug-FXN
16.67%

Norman
Gen:Variant.Adware.Mplug.46
16.67%

ESET NOD32
Win32/Adware.MultiPlug.LX application
16.67%

MicroWorld eScan
Gen:Variant.Adware.Mplug.46
16.67%

Malwarebytes
PUP.Optional.MultiPlug
16.67%

K7 AntiVirus
Trojan
16.67%

Arcabit
Trojan.Adware.Mplug.46
16.67%

Bitdefender
Gen:Variant.Adware.Mplug.46
16.67%

Avira AntiVirus
TR/Crypt.XPACK.Gen
16.67%

AhnLab V3 Security
Win-PUP/MultiPlug
16.67%

The domain a.kindscanmeta.com has been seen to resolve to the following 8 IP addresses.

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
August 27, 2015

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
August 27, 2015

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
August 27, 2015

54.69.228.231
ec2-54-69-228-231.us-west-2.compute.amazonaws.com
June 19, 2015

54.68.13.248
ec2-54-68-13-248.us-west-2.compute.amazonaws.com
June 19, 2015

54.213.72.9
ec2-54-213-72-9.us-west-2.compute.amazonaws.com
June 19, 2015

54.200.195.191
ec2-54-200-195-191.us-west-2.compute.amazonaws.com
June 19, 2015

54.149.241.47
ec2-54-149-241-47.us-west-2.compute.amazonaws.com
June 19, 2015

File downloads found at URLs served by a.kindscanmeta.com.

1 / 68      (Malware)
http://a.kindscanmeta.com/hp/?q=PRYGAS2f73yRwPRJLFvnJI8S83fqL7uTOLOvvq1 0WEU5kCk9oJYc3N0/erc1TqvacuuxOf0x9zs4PtglNYYzz9d8jUhcVCOWg2ZEuOdwxgEYoBwfL7TP1npSU1zYoyXZt0RTFxr3vivuqXV8RrqKhnSQ4OvZtNZp1dU2/KSxrNtLVIaOIY 8LGMm9dNoG2WTACkk9wTwdWki wXdm60NnEfTpwL6JxbC1/oOgG7N7WnjbYyfxeXBtbYbk6F1XHGdzf 5C9FRD63eckop8WgXBd7CjmsNZgEP7CNpE50X3qguRelM2AQEOC7F4 bu3xQFIegeAF6qYmiXwxXbrVHDgf/8uc9Ee5n8u1r38gc8h6caieBR7WaeyJSG7CXAxOv8tajpMnmWC098TKvUcLmeUutSNXdAM/F uUaKUAzjVTsL3GMnFNCUtkKZIekqoDRg WksnBwWo5kTzWfYSxM ucb92RZu/S7N8g7VcgxTlcUup4VYrzTJUvOHn8nyMkNHs9j 7JsFpoIE85qkRy45FdtC6PBGKI6WXiVBmgSyMgdM0qw37FVp2tp7b7WRIO4OkAHiZOTvI5YOUsFwe7gtsquI6Uj8/y5BAP72nKCVbsD/.../KTehSn4vn 5rmNwrl 4rnrKMz4d2eh5srTn4ob&external_id=1433741477471748330  (download l.a. noire_ the complete edition repack free pc game.exe)

1 / 68      (Malware)
http://a.kindscanmeta.com/hp/?q=xfoexZ06F8H23FHwysj4H6Yb9wwG8B7MsS/P9J w4W1eGhlW2GRmwbhM6k3 THgmN44g51VxxKY4qYjhCStS5Dqhww7Bb8O7hsOtFDlygHDUAllqeSriZ6X0iBx5tQym2KZ6L4A9IckYdlA 39Eul2gmsYWc UnUiQOuzTBUrjsXWqoa3o35EQtnSCXjV/DSiA9/pQ1q7kfnm/P xDeL iupo9TSjAKAxMAKIPSsn6YthtYXoBmCXH1KZ5Z0Nde9spZsNopEuFQfZW4eyHcsS6ekGGM9lXqGtfS7lhVjpHJrawGkX8aFryAora0BRGhjYTHImIuJrRjlqen1a IwY7O0ZDLv9IPTbvas5C7oBE/9B5TqGRbY2aDdIY3maX/xB4g1chFSG4K67fQShIApEen8i7y30O/Nc wX2zPST 363Zfn6K7G8OdBSfnuognCSEx8kXENXFCWLSONki/6wUyZ6VVmyMhLRgnMjNxLkj35EMcdzO4MlHZywyJmbTHhbPXaUo48jolt UQeNuK4ntLxOJFC2DcPULKmrisdkNO4pAZEEXk/ch0c W9f1NSlbu/V9p4cz4sAiDkhKeOMA4tiwwCPOSFdt Tf1eogrEBnG2D7h7TLYgxVIzWgi/H5pBNHYc1LHS5EcX1fmf4EaFTeSY3b6YdtWH1gJMgqmutQIARjIa1f5QyUjVSuH8Xm6U9ELFDodbSB6d4QxfG9e0oIkzhh/.../Y68Fi&external_id=1433746753939750918  (keygen_for_nitro_pro_9.5.2.29_(x86-x64)_at_www.softwarespatch.com.rar.exe)

1 / 68      (Malware)
http://a.kindscanmeta.com/hp/?q=LmZH7VCPvWOu56789/OPb9QfaAyxH8ZD /ygScsSd9Uf3p/Okp4ndhaBusM/MwLhAclfKhSjbKMAA1iFLhruJ kHho3gGt 4neJGS8TvZ0CmRgW3ghf2TcfuJfgrOEQL1FW2zYgu8FeDIODokaTHZrgI3X4YBK80rHJkY dtyPv4LK0vo41YdXq/2 XHK7FMjLTaP0FujWhNh9IZM1zVzWCbKNodYU96uUpKz68yabOXrM smwYG8nf/.../WS2xe2UL353HTwuUmZS3UknJ&external_id=1433747169373450495  (keygennitro9.zip.exe)

1 / 68      (Malware)
http://a.kindscanmeta.com/hp/?q=dxUxCLm11VDKqomjlh5qGoX71h5bnQXn3fUhkht6H2BCJzVlDULDcwYTKqDvyr7pz2BDmYWM/uZTBXPwj wOLRIJsiXyETF0v9Cx8SIO6JPKW3S1E/a5DkNXMIWgaSkns5vFyeb8G/04AI2OvtOurW1XpbZQ/017JUVo1AF5lG8eqz4O9qSd7p9QFMmMMmuo4ZsLn7TiE1lPZBAcqfy/jjBwgf8AH59kezh4O8qycbcmKMpw8iKe7IdznsydjGBs6zS8W3u4bgxXQAZnVvZFaNlX5c07bcrGnzU UyaaKOROLvOIc 9Glq/DtIMqLJfDqVgLC8S534RskUXk82EM2oSta76of/osYdHuYVx6PJBC9gzwhWmvdE2ABEysMt7F1owIRI qYr1izxOUX4f1SxHKUVp4zIbjKqRdX8N3KpqynNGyP4fI8gXxBRDdc JHfEfPP7wfsijkSxFpINfcNPae50q 3Fa1Wp tlpFQn2yjNoxXL/7XszcHC7krP3KUaJONboms7TtxfSK26sKOIiKYFKk4jB/e/BccsVBg1y7RZY/szcOAfqLTAQcOu7VsUtQPAPE7L7feFU0OZMMzqwIrNi3NYQgYZWP7d76D99KxtEqOu5H6KtzvxuXuqDBzyuKHJUUgW/DGpjP4x ZYPs1MUwXXAQ6HHoeqFfDtxYmnCWo6ZMZm9a6G5zF376wejAH2OAVGRt0SDRUg9j7/.../G3BI3Wz87aPP5iwUoi&external_id=1433744378939500962  (solarwinds_orion_npm_10_4_1_ipam_3_ncm_7_nta_3_10_sam_5_2_vnqm_4_by_g_ddi_rar.exe)

1 / 68      (Malware)
http://a.kindscanmeta.com/hp/?q=47bWS3i318qVTVNPRJz0aocNrvP47Br9 an64B2cgPXW3xP6HC1FMgYsEmIJItZIffbWx2zVyUeoFUGrgsAqyJrlzsgVTVLS3OBwHf516 F 8ueQrU1FUfNyX/.../tFm4GHUEJwQWxdI8Qlztz84nERiStmdW58slwUvrT5cQ5b54z9AKe8V6g9riW9novomlap8xgPXRbSzZIMjvHB3paiIZlKs3x vFAowlTA9d1sT9 uJ6k7Do5VI8YonKkUm0tDGwVmyY8nEhxIgn ORLnPS2rxzQGlqjTlTnCoGr82hEp1YYS0Iefj5E4BaYerB46QbDuoc7cQ5RoJiQA1E8yWqU6LrbLgAFBlKUFYdPGyYBVwHv48qCZz4v2QAJmxy7a wbU7UTGAQZ bASQKgxpdc5 oz7Pbyx306ly6NdLNy6IbAyq1xcyHrzxIqeSR&external_id=1433751282104438303  (crack incl setup by piratecity.net.exe)

17 / 68    (PUP)
http://a.kindscanmeta.com/hp/?q=jPjAtEg1lrPXsefABCVekNwFAyIFLADNeSgZFaI1jjo6DhrGiVSSD/eaTmfrToF0jI29y/A8VC2GB/.../ed3PFVYQBzCsTbLHH4LEcgaxKlD4WolaW6KqZsA6btPRiFXYCUgzbsLjHOlX2B3aNToF0tGer36m2Ek9kW6wvoJPVXMQRn2d3ZTSOrg40ByN3hlX0i9TwvuKCPqMEIbqgTkfwZAO2jbl 20zNbXQ9yo3VFSYmDjdWYY4hS AeaMfved9qk67XzyFYINbt&external_id=1433746386827809248  (hack v.1.7.3.exe)

The following 9 files have been seen to comunicate with a.kindscanmeta.com in live environments.

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

TCP » 54.149.241.47:80
papers please v1.0.41 setup.exe

TCP » 54.149.241.47:80
installer_game develop.exe

TCP » 54.213.72.9:80
setup installer.exe (Win by Microsoft)

TCP » 54.213.72.9:80
tmp5600.tmp

TCP » 54.213.72.9:80
tmp61f7.tmp

TCP » 54.68.13.248:80
tmp781a.tmp

TCP » 54.69.228.231:80
download.exe

URL:
http://a.kindscanmeta.com/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
openresty

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.