home

collapse-dilogiya-rus-repack-ot-rg-mehanikitorrent_id1198379ids1s.exe

mediaget-installer Module

Inbox OOO

The application collapse-dilogiya-rus-repack-ot-rg-mehanikitorrent_id1198379ids1s.exe, “MediaGet installer” by Inbox OOO has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. The file has been seen being downloaded from www68.uptobox.com and multiple other hosts. While running, it connects to the Internet address sw90.ua-hosting.company on port 80 using the HTTP protocol.
Publisher:
MediaGet LLC  (signed by Inbox OOO)

Product:
mediaget-installer Module

Description:
MediaGet installer

Version:
1.0

MD5:
d179a6388138e4140a372b4184ab0c8a

SHA-1:
f174202587f7d150a10658ebb37e6beab3be16e5

SHA-256:
8917b67aa651e8ae6b9b29dcb014c84b63bfd2997b4057cf953668f8ecbb7bec

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
4/24/2024 8:23:42 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.MediaGet.Inbox.Installer (M)
16.3.21.12

File size:
544.8 KB (557,912 bytes)

Product version:
1.0

Copyright:
Copyright (c) 2011 MediaGet LLC

Original file name:
mediaget-installer.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\collapse-dilogiya-rus-repack-ot-rg-mehanikitorrent_id1198379ids1s.exe

Digital Signature
Signed by:
Inbox OOO

Authority:
COMODO CA Limited

Valid from:
2/16/2016 3:00:00 AM

Valid to:
9/17/2017 2:59:59 AM

Subject:
CN=Inbox OOO, O=Inbox OOO, STREET="16 of. 2, per. Monetchikovski 5-I", L=MOSCOW, S=MOSCOW, PostalCode=115054, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00AE2F0B53DD74EA62BD9A5322DC2C5632

File PE Metadata
Compilation timestamp:
3/21/2016 1:19:12 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
12288:9CVn9FhJRKpQ57lp62HJNKVinguZhMZERuImJF49zFTV:UnHfJlpTUad3qEsyf

Entry address:
0x154FA0

Entry point:
60, BE, 00, F0, 50, 00, 8D, BE, 00, 20, EF, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B...
 
[+]

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:
284 KB (290,816 bytes)

The file collapse-dilogiya-rus-repack-ot-rg-mehanikitorrent_id1198379ids1s.exe has been seen being distributed by the following 50 URLs.

http://www68.uptobox.com/d/.../marley-ve-ben_id1717026ids2s.exe

http://www.installadpro.com/indiralt.php?&t1=fullprogramlaralt&is=Euro Truck Simulatör 2 Türkçe Full 1.23 indir 29 DLC Gold

http://sub2.admitlead.ru/sb/clk/s/1439/h/e67424/o/471/.../ff?a=1&f=Adobe After Effects CC 13.7.1 Full 2015 indir

http://sub2.bubblesmedia.ru/sb/clk/s/1556/h/b8dba2/o/145/.../0?a=1&f=Minecraft 1.7.2 Full indir – Tek Link

http://sub2.admitlead.ru/sb/clk/s/1439/h/e67424/o/471/.../ff?a=1&f=Format Factory 3.8.0.0 Video Cevirme Turkce indir

http://sub2.bubblesmedia.ru/go/?link=uju9YKxcJC6qxO3WIuNCJHeelaGPOjd2kKWcxP1k9Q7tjvV6MunhKtFl0VOCHvML3XH3XNoTY8fQ3Yk MqWVbDvhYe21Oi/r1y2UDhu2kz2hdFJrfYQJHUvvm/.../sJdAKW4J2xEkYI=&param=kmVKRGlvCmc=&un=56fa9f719bbe8&rid=3518

http://www.indirads.org.uk/Crood’lar – The.asp

http://sub2.admitlead.ru/sb/clk/s/901/h/fceed1/o/471/.../0?my_affiliate_id=reklamtrk.com&f=CreedundefinedEfsaneninDogusuTürkçeDublajIzle&data_send_to_me=388DFD4B194DDFA7AF880FD9981DC0AD47A8D76F_arasfilmizle.com_1208w5

http://www.installadpro.com/indir.php?&t1=fullprogramlarust&is=RemoveWat Full indir 2.2.6 x86 x64 Bit Tam Yeni

http://sub2.admitlead.ru/sb/clk/s/702/h/255426/o/471/p/1488/.../0?a=1

http://sub2.bubblesmedia.ru/go/?link=/TsREQKKPqTR0WGMOf4ALtpb0rA5VZq/Dnw2a05IzCu6ECOUUxohKeTGOa4sJ4EL/.../0q867yrEka3UoacDSFBD9jo76FiqjiBCPE0vBj4LfWGDbYP&param=qKhn8phXshk=&un=56f669b1b36cc&rid=3850&f=Need for Speed: Underground 2 - Torrent Oyun indir, Full Oyun, Oyun Yukle, Tek Link Oyun, Demo Oyun

http://sub2.bubblesmedia.ru/sb/clk/s/3150/h/455aae/o/145/p/2861/.../0?a=1&f=Clash Of Clans Hile Mod Apk 0 Çalisir

http://sub2.bubblesmedia.ru/go/?link=v9DgIzqFocC7cOGJ0aQwtXfV HQHr5/.../o1n NgJ4Ex95N72067HTfHoif PuPL1M9XrxeEpjTVSLs&param=4iWyGLAXxrc=&un=56fb13aef076b&rid=731&s= 5417 - Dragon Ball Kai Ultimate Butouden (USA)&r=decemuladores.com&f= 5417 - Dragon Ball Kai Ultimate Butouden (USA)&cs=windows-1252&u=

http://sub2.bubblesmedia.ru/go/?link=31f1FIMhcc7jwT3H7O8otfchd4e5UJbzT3R7rUOqgyUyvxiijf8ir/.../cNNcFCycv p35BcnRslpTxyhKsVRzOOB7BwRSB39homJ3xm9RFPvlVq3pBOZd3PeX TlUMksNkstQMhrHa50B 4YmX6Y8eyI9dq32Dge&param=XLtCAglBpU4=&un=5700c6b84ddce&rid=1482&f=Fifa 15 - 2015 - TORRENT - TURBOBIT Full indir

http://sub2.admitlead.ru/sb/clk/s/1345/h/83026c/o/471/sub/0?a=1&u=http://brator.org/.../SpongeBobe_SquarePants(697.09 MB).torrent&f=Spongebobe-squarepants.torrent

http://sub2.admitlead.ru/sb/clk/s/1439/h/e67424/o/471/.../ff?a=1&f=WWE 2K16 Full 2016 Indir PC Update

http://sub2.bubblesmedia.ru/go/.../A9Tvwku snnU8cCJNnwpYjVkB7k&param=IfrkXhpBPfQ=&un=56fbc7fa90836&rid=3850&f=Counter-Strike: Global Offensive - Torrent Oyun indir, Full Oyun, Oyun Yukle, Tek Link Oyun, Demo Oyun

http://sub2.bubblesmedia.ru/sb/clk/s/706/h/9403d0/o/145/sub/0?a=1&f=Stranded Deep (2015/PC/Eng) by tg&u=http://.../Stranded Deep_1422087103.torrent

http://sub2.admitlead.ru/sb/clk/s/901/h/fceed1/o/471/.../0?my_affiliate_id=reklamtrk.com&f=TürkEgitimSistemiVeOkulYönetimi&data_send_to_me=263DC6A4D9DA2F73CE116F314316673034803F53_www.alanturkce.com_random

http://sub2.bubblesmedia.ru/sb/clk/s/706/h/9403d0/o/145/sub/0?a=1&f=Ben and Ed [2015|Eng]&u=http://.../hibenandediso_1454342821.torrent

http://www.installadpro.com/indir.php?&t1=fullprogramlarust&is=Iron Man Full PC Indir

http://ld.mediaget.com/index2.php?l=tr&r=toolbartr.com13&f=windows-xp-pro&bbls_client_id=285864822&bbl=1&bbl_clk_id=570453-1459612496&use_f=1

http://sub2.admitlead.ru/sb/clk/s/901/h/fceed1/o/471/.../0?my_affiliate_id=reklamtrk.com&f=KarekökYayinlari11.SinifBiyolojiSoruBankasi&data_send_to_me=ADAC9CF0FF669DAD82E003C2B22E177E99D6BE5C_ucretsizpdfindir.net_manuel

http://tinyurl.com/.../RemoveWat 2.2.6

http://sub2.bubblesmedia.ru/go/.../6kCsrt3wU=&un=56fd5fad1b14c&rid=731&s= 4522 - The Legend of Zelda Spirit Tracks (EUR)&r=decemuladores.com&f= 4522 - The Legend of Zelda Spirit Tracks (EUR)&cs=windows-1252&u=

http://sub2.admitlead.ru/sb/clk/s/1439/h/e67424/o/471/.../p1?a=1&f=Counter Strike . Global Offensive Full Turkce Indir

http://ld.mediaget.com/index2.php?comment=s1368|l152|j3242&r=al_adsterra.com&bbls_client_id=279913697

http://get.tvlend.net/sb/clk/s/992/h/e20d87/o/145/p/994/sub/0?a=1&u=http://tvlend.net/uploads/torrent/.../tvlend.net-the-hateful-eight-416986.torrent

http://goo.gl/0YGAFV

http://sub2.bubblesmedia.ru/go/.../nAu20MZg2O90m5MvswQ3VMI0v2fU Jrq&param=b7bVre7MMTc=&un=56f7ddc29ac45&rid=731&s= 0127-Pok?mon: Edici?n Blanca (ESP) (FIX)&r=decemuladores.com&f= 0127-Pok?mon: Edici?n Blanca (ESP) (FIX)&cs=windows-1252&u=

Latest 30 of 867 download URLs

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to sw90.ua-hosting.company  (91.215.156.143:80)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.