home

GuardMailRu.exe

GuardMailRu Module

LLC Mail.Ru

The application GuardMailRu.exe by LLC Mail.Ru has been detected as a potentially unwanted program by 12 anti-malware scanners. This file is typically installed with the program Guard@Mail.Ru by Mail.Ru. While running, it connects to the Internet address kojura.mail.ru on port 80 using the HTTP protocol.
Publisher:
LLC Mail.Ru  (signed and verified)

Product:
GuardMailRu Module

Version:
1, 0, 0, 626

MD5:
9b3f6ac4b21a14a974207b2ddac9b0b6

SHA-1:
2bbd0ba6b5a6744d59671addcf803ecee978e0a7

SHA-256:
22fc8e9d90197065d00810f7c6411e1459087832616ca7bf09cb8aaa0b3818b9

Scanner detections:
12 / 68

Status:
Potentially unwanted

Analysis date:
4/26/2024 3:00:03 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:BrowserTakeover-A [PUP]
2014.9-140328

AVG
MalSign.Generic
2015.0.3521

Baidu Antivirus
Trojan.Win32.RuMail
4.0.3.14328

Bkav FE
W32.Clod21c.Trojan
1.3.0.4613

Comodo Security
Application.Win32.RuMail.pwhe
17604

Dr.Web
Adware.Downware.533
9.0.1.087

herdProtect (fuzzy)
variant of 1fb14b6b46ba4705a1b7d9ba00aaee96.exe
2014.4.6.19

McAfee
Artemis!E3169A1E78E0
5600.7177

Reason Heuristics
PUP.Optional.MailRu.L
14.3.28.18

Rising Antivirus
PE:Trojan.RuMail!1.6574
23.00.65.14326

Sophos
RsMall
4.94

Trend Micro House Call
TROJ_GEN.F47V0614
7.2.87

File size:
6.4 MB (6,723,616 bytes)

Product version:
1, 0, 0, 626

Copyright:
Copyright 2010

Original file name:
GuardMailRu.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\mail.ru\guard\guardmailru.exe

Digital Signature
Signed by:
LLC Mail.Ru

Authority:
Thawte, Inc.

Valid from:
12/9/2011 4:00:00 AM

Valid to:
2/7/2014 3:59:59 AM

Subject:
CN=LLC Mail.Ru, O=LLC Mail.Ru, L=Moscow, S=Moscow, C=RU

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
1C09DBBC732D4B58F7A88EBACF323417

File PE Metadata
Compilation timestamp:
2/4/2014 6:35:39 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:wxuB5jnehO9Igf1v5T8uAZa/LkXRtyL7J4yrZPJiq/LXKMUXTTSFaSTcHG0TZg5E:wcehuCa/LkqnayrTzXbYnO0mDe8ioBb+

Entry address:
0x192220

Entry point:
E8, E4, AC, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 5D, E9, 86, 0F, 00, 00, 8B, FF, 55, 8B, EC, FF, 75, 08, 51, E8, D1, AD, 00, 00, 59, 59, 5D, C2, 04, 00, 8B, FF, 51, C7, 01, CC, F1, 63, 00, E8, 4D, AD, 00, 00, 59, C3, 8B, FF, 55, 8B, EC, 56, 8B, F1, E8, E3, FF, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, B8, FF, FF, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 83, C1, 09, 51, 83, C0, 09, 50, E8, 81, AE, 00, 00, F7, D8, 59, 1B, C0, 59, 40, 5D, C2, 04, 00, CC, CC, CC, CC, CC, CC...
 
[+]

Code size:
2.1 MB (2,167,808 bytes)

The file GuardMailRu.exe has been discovered within the following programs.

Guard.Mail.ru  by Mail.Ru
Guard.Mail.ru is part of the Guard Mail service.
www.mail.ru
42% remove it
Guard@Mail.Ru  by Mail.Ru
Guard@Mail.Ru is part of the Guard Mail service.
42% remove it
 
Powered by Should I Remove It?

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to kojura.mail.ru  (217.69.133.27:80)

Remove GuardMailRu.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.