home

syspro-file.ru

Artex Management S.A.

Domain Information

The domain syspro-file.ru registered by Artex Management S.A. was initially registered in April of 2015 through RU-CENTER-RU. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Moscow, Moscow City within Russia which resides on the RIPE Network Coordination Centre network.
Registrar:
RU-CENTER-RU

Server location:
Moscow City, Russia (RU)

Create date:
Thursday, April 9, 2015

Expires date:
Saturday, April 9, 2016

ASN:
AS48287 RU-SERVICE-AS RU-SERVICE Ltd,RU

Whois:
1 syspro-file.ru record

Scanner detections:
Detections  (60% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.ZAXAR, Threat.1GB, PUP.SpeedChecker.Optional.Installer.Meta (L)
60.00%

Dr.Web
Adware.Zaxar.7, Trojan.Zadved.61
40.00%

AVG
Generic, Downloader
40.00%

Malwarebytes
PUP.Optional.Zaxar.A
20.00%

Trend Micro House Call
Suspicious_GEN.F47V0118
20.00%

G Data
Win32.Application.Zaxar
20.00%

McAfee
Artemis!B9D958C7DD4C
20.00%

ESET NOD32
Win32/ZaxarGames.D potentially unwanted (variant)
20.00%

Fortinet FortiGate
Riskware/ZaxarGames
20.00%

ESET NOD32
Win32/eTranslatorPro.A potentially unwanted application
20.00%

The domain syspro-file.ru has been seen to resolve to the following 3 IP addresses.

194.85.61.76
expirepages-kiae-2.nic.ru
April 20, 2016

109.70.26.37
expirepages-kiae-1.nic.ru
April 20, 2016

200.7.96.17
March 3, 2016

File downloads found at URLs served by syspro-file.ru.

4 / 68      (Adware)
http://syspro-file.ru/.../3265a56b2c93fa405be9ed78117e9200.exe  (etranslator.exe)

9 / 68      (Adware)
http://syspro-file.ru/.../6c6ab530033e53f9f6868b16cc93ac89.exe  (zaxarsetup.4.001.33.exe)

0 / 68
http://syspro-file.ru/.../1e6ae614bc2297ee271aca61b16a701e.exe  (eaecd047-1fb3-446b-ad14-1f7d27ccafb1.exe)

1 / 68      (PUP)
http://syspro-file.ru/.../c2d063d9a515fd62acd35a6512c36d3a.exe  (pcspeedup.exe)

4 / 68      (Adware)
http://syspro-file.ru/.../168741b6d3109a5fab5b500e7af5d682.exe  (etranslator.exe)

0 / 68
http://syspro-file.ru/.../h-0975049a3a9ff137c00dae7dac843671.exe  (e47d1d1d-5137-46b3-ba88-7a6ed0b64015.exe)

The following 15 files have been seen to comunicate with syspro-file.ru in live environments.

TCP » 109.70.26.37:80
online-guardian-v2.0.9.exe

TCP » 109.70.26.37:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 109.70.26.37:80
7eda.tmp.exe

TCP » 109.70.26.37:443
client.exe (ClientWrapper)

TCP » 194.85.61.76:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

TCP » 109.70.26.37:80
onlineguardian-v2.exe

TCP » 194.85.61.76:443
Proxomitron.exe (Proxomitron by Groom-A-Zebu (tm))

TCP » 194.85.61.76:80
7eda.tmp.exe

TCP » 109.70.26.37:993
produpd.exe (produpd.exe by Vested Development, Inc)

TCP » 109.70.26.37:80
oujzmdpj.exe

TCP » 109.70.26.37:9997
svchostupdate.exe

TCP » 109.70.26.37:80
UCBrowser.exe (by UCWeb)

TCP » 194.85.61.76:443
client.exe (ClientWrapper)

TCP » 109.70.26.37:443
injector.txt (Windows by Microsoft)

TCP » 109.70.26.37:80
online-guardian-v2.exe

TCP » 109.70.26.37:80
dsjrdhmsdoen.exe

TCP » 109.70.26.37:993
produpd.exe (produpd.exe by Vested Development, Inc)

TCP » 194.85.61.76:80
oujzmdpj.exe

URL:
http://syspro-file.ru/

Web server:
nginx/1.2.1 (PHP/5.4.45-0+deb7u2)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.