» dlc.morepays.ru
Overview
Analysis
IPs Addresses (1)
Downloads (7)
Statistics
Related Domains (5)

dlc.morepays.ru

Private Person (Proxy Registrant)

Domain Information

The domain dlc.morepays.ru is registered by proxy through REGRU-REG-RIPN and was originally registered in July of 2013. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Moscow, Moscow City within Russia which resides on the RIPE Network Coordination Centre network.

Registrant:

Private Person

Registrar:

REGRU-REG-RIPN

Server location:

Moscow City, Russia (RU)

Create date:

Thursday, July 11, 2013

Expires date:

Friday, July 11, 2014

ASN:

AS42632 MNOGOBYTE-AS MnogoByte LLC

Root domain:

morepays.ru

Whois:

1 morepays.ru record

Scanner detections:

Detections (100% detected)

Scan engine

Details

Detections

MicroWorld eScan

Gen:Variant.Graftor.76116, Gen:Variant.Symmi.27719

85.71%

K7 AntiVirus

Trojan

85.71%

Bitdefender

Gen:Variant.Graftor.76116, Gen:Variant.Symmi.27719

85.71%

Comodo Security

TrojWare.Win32.Kryptik.AXJX

85.71%

Emsisoft Anti-Malware

Gen:Variant.Graftor.76116, Gen:Variant.Symmi.27719

85.71%

G Data

Gen:Variant.Graftor.76116, Gen:Variant.Symmi.27719

85.71%

IKARUS anti.virus

Virus.Win32.Cryptor

85.71%

AVG

Win32/Cryptor

85.71%

McAfee

BackDoor-FBDY!31DD66FF94BF, BackDoor-FBDY!7C25B7191E54, BackDoor-FBDY!6DE5AA2CF0D4, BackDoor-FBDY!13895737BC24, BackDoor-FBDY!B29DF060D9E9

85.71%

Malwarebytes

Trojan.LoadMoney

85.71%

Reason Heuristics

PUP.SharapovaSvetlanaBorisovnaIP.I, PUP.SharapovaSvetlanaBorisovnaIP.O, PUP.SharapovaSvetlanaBorisovnaIP.Q, PUP.SharapovaSvetlanaBorisovnaIP.N, PUP.SharapovaSvetlanaBorisovnaIP.p

85.71%

Dr.Web

Trojan.LoadMoney.17

71.43%

avast!

Win32:Downloader-UFC [PUP]

71.43%

Sophos

Generic PUA GO, Mal/Generic-S

71.43%

Avira AntiVirus

TR/Graftor.76116.653, TR/Graftor.76116.421, TR/Graftor.76116.453, TR/Graftor.76116.91, TR/Graftor.76116.529

71.43%

The domain dlc.morepays.ru has been seen to resolve to the following IP address.

146.255.192.10

loadmoney.ru

November 16, 2013

File downloads found at URLs served by dlc.morepays.ru.

1 / 68 (PUP)

http://dlc.morepays.ru/download/c8d4d4d09a8f8fc7cfccc4c3c5ced4d2c58ed2d58fc7c5d4ffd8cdcc9f/cdccd2c4c9c49d92989993949592929886c6c9ccc5ffc9c49d/00d0a7a0/.../offerid_403203_pkgqty_1_culture_en-us_affid_773.exe (9546bde7e6710dc2c235ed8c25db0897)

12 / 68 (PUP)

http://dlc.morepays.ru/download/e3fffffbb1a4a4e8eaedeeece4e4efa5f9fea4e2e5ede4b4/fbedf8f8ffe4f9f2b6edbbbde8bfbabdbab8bdb3edbbeaadede2e7eeb6/0004d98b/.../tainstvennaya_nahodka_tfile_ru.exe (884e4446a07bd87a8178c4fe6cb5e7b5)

19 / 68 (PUP)

http://dlc.morepays.ru/download/0b171713594c4c040c0f0700060d1711064d11164c0406173c1b0e0f5c/0e0f11070a075e515a5353565652555645050a0f063c0a075e/0431dc63/.../jovesmodpack_0_8_7_v6_1.exe (b29df060d9e944fd00baf7f0874f2ba8)

18 / 68 (PUP)

http://dlc.morepays.ru/download/4f5353571d080840484b4344424953554209555208404253785f4a4b18/4a4b55434e431a151f1e1e11141f1f1001414e4b42784e431a/0529d127/.../lost-planet-3.exe (13895737bc24dceb5ed0e5c9a94cb2fe)

20 / 68 (PUP)

http://dlc.morepays.ru/download/7f6363672d383873607a7b736539656238707263486f7a7b28/7a7b65737e732a2625232426272f262531717e7b72487e732a/00429e17/.../wot_jovesmodpack.exe (6de5aa2cf0d41c54da392b689a44b96a)

19 / 68 (PUP)

http://dlc.morepays.ru/download/a5b9b9bdf7e2e2a9baa0a1a9bfe3bfb8e2aaa8b992b5a0a1f2/a0a1bfa9a4a9f0fcfff9fff4fafdf5f8ebaba4a1a892a4a9f0/0043f6cd/.../flashplayer_13.exe (7c25b7191e543a3dca79532a45868b89)

19 / 68 (PUP)

http://dlc.morepays.ru/download/eaf6f6f2b8adade6f5efeee6f0acf0f7ade5e7f6ddfaefeebd/efeef0e6ebe6bfb3b0b6b0bbb5b1b6bba4e4ebeee7ddebe6bf/00392382/.../itree-v1.exe (31dd66ff94bfab4efa4adeae09ad36b1)

Alexa:

Global rank: 6,232,230

Backlinks: 1

Statistics are for the previous month (Alexa statistics are for entire morepays.ru).

Related Domains

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.