home

3x04-and-now-his-watch-has-ended-game-of-thrones-online-subtitulado-miragameofthronescom_id4265919id

mediaget-installer Module

Media Get LLC

The file 3x04-and-now-his-watch-has-ended-game-of-thrones-online-subtitulado-miragameofthronescom_id4265919id, “MediaGet installer” by Media Get has been detected as a potentially unwanted program by 14 anti-malware scanners. The file has been seen being downloaded from sub2.bubblesmedia.ru and multiple other hosts. While running, it connects to the Internet address 163-172-220-89.rev.poneytelecom.eu on port 80 using the HTTP protocol.
Publisher:
MediaGet LLC  (signed by Media Get LLC)

Product:
mediaget-installer Module

Description:
MediaGet installer

Version:
1.0

MD5:
2b08f1c331aef2197a19bf5d11442528

SHA-1:
ab7da00b5bddbdc3e37fab64f602ea531995a492

SHA-256:
d274cf57888ce2204208d190a1a91b19484a1c5ee841ee574634750523633335

Scanner detections:
14 / 68

Status:
Potentially unwanted

Analysis date:
4/18/2024 9:49:55 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
APPL/MediaGet.Gen5
7.11.131.32

AVG
Luhe.MediaGet.B
2015.0.3565

Comodo Security
UnclassifiedMalware
17774

ESET NOD32
Win32/MediaGet (variant)
8.9414

F-Prot
W32/MediaGet.A.gen
v6.4.7.1.166

G Data
Win32.Adware.MediaGet
14.2.24

K7 AntiVirus
Unwanted-Program
13.175.11150

Kaspersky
not-a-virus:HEUR:Downloader.Win32.MediaGet
14.0.0.4320

Malwarebytes
PUP.Adware.MediaGet
v2014.02.12.11

Reason Heuristics
PUP.Optional.Installer.MediaGet.AA
14.2.12.23

Sophos
MediaGet
4.97

Trend Micro House Call
TROJ_GEN.RCBCOEI
7.2.43

Trend Micro
TROJ_GEN.RCBCOEI
10.465.12

ViRobot
Trojan.Win32.S.Agent.741664
2011.4.7.4223

File size:
724.3 KB (741,664 bytes)

Product version:
1.0

Copyright:
Copyright (c) 2011 MediaGet LLC

Original file name:
mediaget-installer.exe

Language:
English (United States)

Common path:
C:\users\{user}\downloads\3x04-and-now-his-watch-has-ended-game-of-thrones-online-subtitulado-miragameofthronescom_id4265919ids2s.exe

Digital Signature
Signed by:
Media Get LLC

Authority:
The USERTRUST Network

Valid from:
3/8/2011 9:00:00 PM

Valid to:
3/8/2014 8:59:59 PM

Subject:
CN=Media Get LLC, O=Media Get LLC, STREET=Sadovaya 53, L=Saint-Petersburg, S=Russia, PostalCode=190344, C=RU

Issuer:
CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US

Serial number:
71D26D579AEE6A768F27CF3B6D4E9A91

File PE Metadata
Compilation timestamp:
4/11/2013 7:28:59 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
12288:Mb1slbMgGYbJOfHnszT8R6UOdp5lggCcRzW7xNOMfq33sUn6pxeTUpPhF0sHGIpZ:MhOPIfnCT/UudfCcRz+Xq33mlpJF0sXn

Entry address:
0x174150

Entry point:
60, BE, 00, C0, 51, 00, 8D, BE, 00, 50, EE, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B...
 
[+]

Code size:
356 KB (364,544 bytes)

The file 3x04-and-now-his-watch-has-ended-game-of-thrones-online-subtitulado-miragameofthronescom_id4265919id has been seen being distributed by the following 17 URLs.

http://sub2.bubblesmedia.ru/go/?link=H WUWlquBlcIuxz9jJaFcYShBevZc 8P32GunHtOScoi64LVR5bjWtH9MFx6 ipnwcWJJZTiG/DqqmzA8wPV41SV0CemuNLYoF9ek tWM2VZgWcD6vWK/1zR8RXiSLoB5ZvowsbGURfrDglay 2nHsBm5btJk5k7Q6sF3XwlBLLgvFpEK/.../Q=&rid=267&s=RemoveWAT 2.2.6 [Activateur Windows 7]&r=french-movies.net&f=RemoveWAT 2.2.6 [Activateur Windows 7]&cs=&u=

http://sub2.bubblesmedia.ru/.../?link=kvYDOXjdiCbV9kVkgZ76ugPb5yA L3N1rFHVUjtXoixHe 3o8EUGIppXl0RvF 9PPftVwGAfkQPYEuu1psRUY3uVEcflaR1MJqsoNoiQRKq94C9IcrsgXnSeLVoEHh6tX5g9fI2pZlXzTuQypoLksGUaNbqLCPoTNThJS4orGTmOtFOCBJuwcU4=&param=tSC9UI2UZ2g=&rid=700&s=LanguagPack - Português do Brasil para Office 2010 e &r=baixar-jogos-completos.blogspot.com.br&f=LanguagPack - Português do Brasil para Office 2010 e &cs=UTF-8&u=

http://ld.mediaget.com/index2.php?l=pt&f=la-mula-2013-ver-online-y-descargar-gratis&s=La mula (2013) Ver Online Y Descargar Gratis&r=tucinecom.com_p

http://sub2.bubblesmedia.ru/go/?link=jltz46c6t7yKzI3HuDCCiG4gOjq9ZFwPm p2KRlZTK0AHlGlVWsvsS4T3niQjJL5L mnlN4zJGbX2ewZ1Kgmt5F1SbYSA/.../Fn JhGKEG8dHwdr5Izw4RATHLoE0zx5ndkfKQbmre5oirjj6A=&param=yuC2DjCiWBw=&rid=743&s=Que bonito amor 132&r=gratisnovelas.com&f=Que bonito amor 132&cs=UTF-8&u=

http://ld.mediaget.com/index2.php?l=es&f=a-haunted-house&s=A Haunted House&r=moviezet.com_p

http://sub2.bubblesmedia.ru/go/?link=SvlHJaYhC9I0QCxXQl42B9jvKo4dRD4m7Vs6q4m7q UEdjb5jBgIhMB9sqAAvWnbfCl8x8Q89cXDVJr1KFpFsjgBAqMb21iPb9rDoUZPnmM8X4Vwxg2/.../2AU=&param=WdJ1JArA7BE=&rid=407&s=3x01: Valar Dohaeris | Game of Thrones Online Subtitulado - MiraGameOfThrones.com&r=miragameofthrones.com&f=3x01: Valar Dohaeris | Game of Thrones Online Subtitulado - MiraGameOfThrones.com&cs=ISO-8859-1&u=

http://mediaget.com/download.php

http://mediaget.com/torrent.php?r=downvids.net&s=Download Facebook Videos&f=Download Facebook Videos

http://sub2.bubblesmedia.ru/go/?link=wzKCKChRtj4bja2MXU0wvTzqlNGWpQjO8dAa4NeQH60/.../zmuiNA vPSWSjQbnYjDsL6jlOv40NHBaTf5YSipUi JB3fpQ1tMPalM9vfL6WjxZqlIsA=&param=63oAUbKfXZY=&rid=308&s= Rebeldes&r=ladescargadirecta.com&f= Rebeldes&cs=UTF-8&u=

http://sub2.bubblesmedia.ru/go/?link=oTu5ZEMICbSvpWR/zpBesWfOKmJjO6Gk 9mp3vo1rx//Ng/wUg8RNfSsJesRRGd7iQpiebfNCPe9AECkFEHIX4X/.../rRlSmdnPRQhOKusxOegPzP61JliDK76iKnYNnFGirj pbxqlRC58Sr5aL0oRWM=&param=t2ujPm1xYtw=&rid=731&s= XXXX - Pokemon Blaze Black 2 (EUR)&r=decemuladores.com&f= XXXX - Pokemon Blaze Black 2 (EUR)&cs=ISO-8859-1&u=

http://mediaget.com/torrent.php?r=casadosfilmex.net&s=Clipe Oficial AH LELEK LEK LEK LEK LEK Geral do Agito - WebRadio Online Grátis&f=Clipe Oficial AH LELEK LEK LEK LEK LEK Geral do Agito - WebRadio Online Grátis&cs=UTF-8

http://sub2.bubblesmedia.ru/go/?link=E/.../aLRrcjEZ83Rk7yeVEYtyuojMiWp41yKfB5gC0lNdB5bZRaNWOSvaEYJ6vlhEsIkYxORUurtd9hUEvoDTec2U8WukGY9337JdeEPz8hc=&param=IRB20ulvAyg=&rid=743&s=Amores daderos 176&r=gratisnovelas.com&f=Amores daderos 176&cs=UTF-8&u=

http://ld.mediaget.com/index2.php?l=es&r=downtwarez.com&f=descargar-pinnacle-studio-14-hd-ultimate-espaolfull-collectioninccrackresubido&s=Descargar Pinnacle Studio 14 HD Ultimate [Espaol][Full Collection][Inc.Crack][Resubido]

http://ld.mediaget.com/index2.php?l=en&r=2baksa.net&f=bejeweled-3-v1086128-by-popcap-games-engfrgeritaspa--&s=Bejeweled 3 v1.0.8.6128 (by PopCap Games) Eng/Fr/Ger/.../Spa »

http://mediaget.com/torrent.php?r=2baksa.net&s=Bejeweled 3 v1.0.8.6128 (by PopCap Games) Eng/Fr/Ger/.../Spa ? &f=Bejeweled 3 v1.0.8.6128 (by PopCap Games) Eng/Fr/Ger/.../Spa ? &cs=windows-1251

http://sub2.bubblesmedia.ru/go/?link=Nd3PNG7HQdcyofSZilhutV9ssXx0 WBazKkpD6Gr0zb0vLlmIEHOxbJ69/6l43TdnzDMfs6tLsAeZ916dnjg4j5nj A7bFKospj3QRGykhrBjn/.../gJalpuobLJ4sE2R1d6V8C3SUfGag3Jf7TTu88=&param=lu4hBcYguo8=&rid=408&s=El libro de la selva de Geronimo Stilton Gratis | Descargar Libro Gratis El libro de la selva | Libros Gratis de Geronimo Stilton,&r=tuslibrosgratis.net&f=El libro de la selva de Geronimo Stilton Gratis | Descargar Libro Gratis El libro de la selva | Libros Gratis de Geronimo Stilton,&cs=UTF-8&u=

http://mediaget.com/torrent.php?r=miragameofthrones.com&s=3x04: And Now His Watch Has Ended | Game of Thrones Online Subtitulado - MiraGameOfThrones.com&f=3x04: And Now His Watch Has Ended | Game of Thrones Online Subtitulado - MiraGameOfThrones.com&cs=ISO-8859-1

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to 163-172-220-89.rev.poneytelecom.eu  (163.172.220.89:80)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.