Domain > mxs.mail.ru

More information on this domain is in AlienVault OTX

Is this malicious?

Files that talk to mxs.mail.ru

MD5	A/V
3dd5efcc8a520c807d40c2ef0e82d155	[TR/Pushdo.C.1] [TrojanDownloader*Win32/Cutwail.BS]
DF6D252125D605891DEBFC85BCF6F5CD
5e5f2ba73005a54ea71e591feff2b1d7	[Artemis!5E5F2BA73005] [Trojan.Win32.Jorik.Cutwail.pgy]
7c5548b8200650440848b5b47e56b2eb	[Artemis!7C5548B82006] [WS.Reputation.1] [Trojan.Win32.Cutwail.cgs] [UnclassifiedMalware] [BackDoor.Bulknet.1150] [TrojanDownloader:Win32/Cutwail.BS] [Trojan/Win32.Tepfer] [Trojan-Downloader.Win32.Cutwail] [W32/Cutwail.CGS!tr] [Trojan.Win32.Cutwail.Azpq]
ef999ee09422d4c4c3fd48c9c439f901	[Win32/Tanatos.N] [Virus*Win32/Sality.H] [W32/Sality.Z]
c05f0c46dbc6bfe046ad7ca12cf9f98e	[W32.Cloda2c.Trojan.5c7a] [PWSZbot-FLN!C05F0C46DBC6] [Spyware.Zbot] [TrojanSpy.Zbot!d3kAaGLa0Gg] [Suspicious.Cloud] [TSPY_ZBOT.WGJ] [Trojan-Spy.Win32.Zbot.qqte] [Trojan.Win32.Zbot.cmzhij] [Trojan.PWS.Panda.4379] [TR/Spy.ZBot.anb.1] [Win32.Troj.Zbot.qq.(kcloud)] [PWS:Win32/Zbot] [Win32/Spy.Zbot.AAU] [Trojan-PWS.Win32.Zbot] [W32/Zbot.QQTE!tr] [Trojan.Win32.Zbot.Ax]
c7fa0586a90ba4e6b68c34f41706eea0	[Win32/Tanatos.N] [Virus*Win32/Sality.H] [W32/Sality.Z] [W32/Sality.p]
69105950b2bb95843dea5937bea0e8f0	[HW32.CDB.5919] [Packed.Win32.Katusha.3!O] [WS.Reputation.1] [Kryptik.CDQY] [TrojWare.Win32.Kryptik.CBCJ] [BackDoor.Slym.13873] [Backdoor:Win32/Kelihos.F] [Trojan/Win32.Tepfer] [Heur.Trojan.Hlux] [Trojan.Crypt_s] [Crypt_s.GNC] [Trojan.Win32.Kryptik.CBCJ]
582f50a8f2e3ce4d11a6a2e657107975	[Virus*Win32/Sality.H] [W32/Sality.Z]
4ef765e9cbbcc279b3ad373c5c46f1b7	[Artemis!4EF765E9CBBC] [Backdoor/Win32.Androm] [Trojan.PWS.Panda.4379]
84f5a6cf3235fec23a916c2223c2e432
00985d5f8a8a6bc9d3b99e5a74c51fe6	[Win32/Tanatos.N] [Virus*Win32/Sality.H] [W32/Sality.Z] [W32/Sality.p]
5345aff5ce85c0d99c484f2716071b7a	[Win32.Heur.KVMF58.hy.(kcloud)]
c9368a2ab9a9a47d4a29318b0f347dae	[Win32/Tanatos.N] [Virus*Win32/Sality.H] [W32/Sality.Z]
03b35e1371d5fcd9db4ed275802ad6b0	[W32.HfsAutoB.00ad] [Win32.Worm.Bobic.AC] [Net-Worm.Win32.Bobic!O] [W32.Bobic.poly] [W32/Bobax.worm.m] [Worm.Bobic.AV] [W32.Bobax] [Bobax.FRY] [Win32/Bobax.AP] [PE_BOBAX.AK-O] [Net-Worm.Win32.Bobic.ac] [Trojan.Win32.Bobic.vhouc] [Virus.Win32.Heur.k] [W32/Bobax-AC] [NetWorm.Win32.Bobic.A] [Win32.Proxed] [Worm/Bobic.Crypt] [Heuristic.LooksLike.Win32.Suspicious.C] [I-Worm/Bobic.u] [Worm[Net]/Win32.Bobic] [BScope.Trojan.Jorik.IRCbot] [Worm.Win32.Bobic.AGZu] [Win32/Bobax.AL] [Net-Worm.Win32.Small] [W32/Bobic.AC] [Worm/Bobax.AB] [Win32/Worm.BO.0d2]
93f43709e4671efd43c1a59c858850d3	[Win32/Tanatos.N] [Virus*Win32/Sality.H]
f049cc8e1ad58a1d8df5244e5b536251	[Win32/Tanatos.N] [Virus*Win32/Sality.H] [W32/Sality.Z]
390fc8a6672ba631df610de3fc76ad22	[Heur.Win32.Veebee.1!O] [Trojan.LVBP.ED] [W32/Trojan2.OAPU] [TROJ_FORUCON.BMC] [Trojan-PSW.Win32.Tepfer.swki] [Trojan.PWS.Stealer.3128] [TR/Dropper.VB.7976] [W32/Trojan.VAGS-5670] [Trojan-PWS.Win32.Tepfer] [Trojan.Win32.InfoStealer.AY]
abe19665682ad3e10ba09471775c150b	[Malware.Packer.FFS] [Heuristic.LooksLike.Win32.Suspicious.E]
e21b3469b4fc1efddf76d8c89f1ebb2a	[Malware.Packer.HGX1] [Heuristic.LooksLike.Win32.Suspicious.E] [W32/Kryptik.AXUE!tr]

DNS Resolutions

Date	IP Address
2013-10-05	94.100.176.20 (ClassC)
2014-01-30	94.100.176.20 (ClassC)
2014-04-08	213.120.234.114 (ClassC)
2014-04-08	213.120.234.150 (ClassC)
2014-05-05	94.100.180.150 (ClassC)
2014-06-18	217.69.139.150 (ClassC)
2014-09-15	94.100.180.150 (ClassC)
2020-12-30	94.100.180.104 (ClassC)
2025-11-26	217.69.139.150 (ClassC)
2026-01-21	94.100.180.31 (ClassC)

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]