amigobin.cdnmail.ru

MGL Mail.ru Internet Assets Limited

Domain Information

The domain amigobin.cdnmail.ru registered by MGL Mail.ru Internet Assets Limited was initially registered in November of 2008 through RU-CENTER-RU. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Moscow, Moscow City within Russia which resides on the RIPE Network Coordination Centre network.
Registrar:
RU-CENTER-RU

Server location:
Moscow City, Russia (RU)

Create date:
Friday, November 21, 2008

Expires date:
Monday, November 21, 2016

ASN:
AS47764 MAILRU-AS Limited liability company Mail.Ru

Root domain:

Google Safe Browsing:
unwanted

Scanner detections:
Detections  (94% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Optional.MailRu.J, PUP.Optional.MailRu.M, PUP.Amigo (M), PUP.Amigo (L), PUP.Optional.Installer.S, Win32.Generic.MailRu.Meta, Win32.Generic.MailRu.Installer.Meta
100.00%

AVG
MalSign.Generic
11.76%

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h, Downware.LMN.gen
11.76%

Bkav FE
W32.HfsAdware
5.88%

The domain amigobin.cdnmail.ru has been seen to resolve to the following 2 IP addresses.

moscow.cdnmail.ru
January 4, 2016

moscow.cdnmail.ru
January 3, 2016

File downloads found at URLs served by amigobin.cdnmail.ru.

1 / 68      (Malware)

1 / 68      (Malware)

1 / 68      (PUP)
http://amigobin.cdnmail.ru/AmigoDistrib.exe  (d72bcfdb41966bf87eba737643c4cc9c)

1 / 68      (PUP)

1 / 68      (Malware)

1 / 68      (PUP)

2 / 68      (PUP)
http://amigobin.cdnmail.ru/AmigoDistrib.exe  (5806fd46200ee9eb52abb19ce8ac46d3)

2 / 68      (PUP)

1 / 68      (PUP)

2 / 68      (PUP)

1 / 68      (PUP)

1 / 68      (Malware)

2 / 68      (PUP)
http://amigobin.cdnmail.ru/AmigoDistrib.exe  (41aa552e-a3dd-4d56-908e-5ea27f6ec19f.exe)

2 / 68      (PUP)

1 / 68      (Malware)

1 / 68      (Malware)

1 / 68      (Malware)

URL:
http://amigobin.cdnmail.ru/

SSL certificate subject:
CN=*.mail.ru, OU=IT, O=LLC Mail.Ru, L=Moscow, S=RUSSIAN FEDERATION, C=RU

SSL certificate issuer:
CN=GeoTrust SSL CA - G3, O=GeoTrust Inc., C=US

Web server:
nginx