GridinSoft Threat Intelligence

icq_rfrset_501512a8.exe threat report

Detected as PUP.MailRu File reputation report
MD5 47c65cc1f9a839837894e5b465621fea
Latest seen 2023-01-12 23:04:53 (3 years ago)
First seen 2018-05-22 19:01:36 (8 years ago)
Size 34 MB
Product ICQSetup
Signed by LLC Mail.Ru

GridinSoft Anti-Malware detection

Detected by GridinSoft before you download

The current ThreatInfo record shows this exact file hash detected as PUP.MailRu. Download GridinSoft Anti-Malware to scan the device, confirm whether this file is present, and remove the detected object if it is found.

Detection name
PUP.MailRu
Recommended action
Scan and remove
Last analysis
2023-01-12 23:04:53 (3 years ago)
File hash
47c65cc1f9a839837894e5b465621fea
Download Anti-Malware

Why it matters

Why GridinSoft flags this file

Detection

GridinSoft identifies the sample as PUP.MailRu, part of the PUP threat category.

Category context

Potentially unwanted programs, bundlers, installers, and utilities with intrusive behavior. Related PUP reports help compare this file with nearby detections, publishers, and hashes.

Timeline

First seen 2018-05-22 19:01:36 (8 years ago); latest analysis 2023-01-12 23:04:53 (3 years ago).

Publisher context

Product metadata: ICQSetup.

Digital signature

Signed by LLC Mail.Ru. The signature is not reported as trusted and valid, which can indicate tampering, repackaging, or copied publisher data.

Aliases

This hash has appeared under multiple file names, which can happen with repackaging, bundling, or deliberate renaming.

Observed locations

ThreatInfo has seen this file in user or system paths listed below. Unexpected locations increase the need for local verification.

Recommended action

What to do next

  1. Compare the MD5 above with the file found on the device.
  2. Check whether the file appears in the observed locations or under one of the alternate names.
  3. Run GridinSoft Anti-Malware to confirm the detection and remove the file if it is present. Review the PUP category for related samples and common context.

File context

icq_rfrset_501512a8.exe is a Windows file recorded in the ThreatInfo database. It is associated with ICQSetup. The current detection status is PUP.MailRu, based on the latest analysis from 2023-01-12 23:04:53 (3 years ago). ThreatInfo groups this verdict with PUP reports for broader family-level investigation.

If icq_rfrset_501512a8.exe appears on your computer unexpectedly, treat it as suspicious. Check its location, digital signature, and recent system changes before allowing it to run. A full anti-malware scan is recommended when this file is detected as PUP.MailRu.

File Details

Product Name: ICQSetup
MD5: 47c65cc1f9a839837894e5b465621fea
Size: 34 MB
First Published: 2018-05-22 19:01:36 (8 years ago)
Latest Published: 2023-01-12 23:04:53 (3 years ago)
Status: PUP.MailRu (on last analysis)
Analysis Date: 2023-01-12 23:04:53 (3 years ago)

Detection screenshot

icq_rfrset_501512a8.exe detection screenshot

The screenshot is a visual record of a GridinSoft Anti-Malware detection for this sample. Use the hash and metadata above as the primary identifiers when comparing the file on your system.

Overview

Signed By: LLC Mail.Ru
Status: Invalid (digital signature could be stolen or file could be patched)

The signature on icq_rfrset_501512a8.exe is not reported as trusted and valid. Invalid or suspicious signature data can indicate tampering, repackaging, or an unrelated file using copied publisher information.

Common Places:

%temp%
%profile%
%desktop%
%sysdrive%
%profile%\downloads
%sysdrive%\$recycle.bin
%profile%\onedrive\onedrive
%profile%\dministrator\my documents
%sysdrive%\dropbox
%sysdrive%\doc\------ продажи ------------

ThreatInfo has observed icq_rfrset_501512a8.exe in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

File Names:

81 observed names
icq201D.tmp icq_rfrset_f6a7a8d5.exe icq_rfrset_a0c78178.exe icq_rfrset_f82f3676.exe icqD993.tmp icq9CED.tmp icq_10-0-12341_fr_35432.exe icq_rfrset_f1754b0f.exe icq_rfrset_8bf9e877.exe icq_rfrset_41063dd4.exe icq_rfrset_f1462e19.exe $R3JM1B6.exe icq_rfrset_46e87ed6.exe icq_rfrset_4463f201.exe icq_rfrset_4715c4bd.exe icq_rfrset_f68a4cb3.exe icq2D3B.tmp ICQ 10.0 build 12341 Final.exe icqsetup.exe icq_rfrset_06f532fa.exe icq_rfrset_68147e60.exe dvd-firmware-liteon-recorder icq_rfrset_978009e1.exe icq_rfrset_e8874fd5.exe icq_rfrset_0743eed5.exe icq_rfrset_138beb25.exe icq_rfrset_cc2e412f.exe icq_rfrset_fc6750d9.exe icq_rfrset_b5deb3b3.exe icq_rfrset_26af8f6b.exe icq_rfrset_979e9aae.exe icq_rfrset_c88862b4.exe icq_rfrset_11ec6d10.exe icq_rfrset_28db67bd.exe icq_rfrset_fec39ed0.exe icq_rfrset_bb1b1669.exe icq_rfrset_95590cf6.exe icq_rfrset_5b8ff241.exe icq_rfrset_da65e03a.exe icq_rfrset_56310962.exe icq_rfrset_05dee600.exe icqC4B5.tmp icq_rfrset_fa91606f.exe icq_rfrset_9fcbc84f.exe icq_rfrset_5db510d4.exe icq_rfrset_49b3ca94.exe icq_rfrset_33dab138.exe icq_rfrset_2adedf8f.exe icq_rfrset_b116808a.exe icq_rfrset_eb38a453.exe icq_rfrset_09c699ac.exe icq_rfrset_f20b0bea.exe icq_rfrset_fd535b60.exe icq_rfrset_e1c0cec7.exe icq_rfrset_aeadbe0e.exe icq_rfrset_bacb3af3.exe icq_rfrset_05ca9d1c.exe icq4153.tmp icq466E.tmp icq8FA0.tmp icqC032.tmp icq9E3A.tmp icq1129.tmp icq34B2.tmp icq_rfrset_5167243c.exe icq_rfrset_3a112beb.exe icq_rfrset_22a13c2c.exe icq_rfrset_cd65995c.exe icq_rfrset.exe icq_rfrset_b1e28a97.exe icq_rfrset_e21a65cc.exe icq_rfrset_d5c37cfd.exe icq_rfrset_fa948f8d.exe icq_rfrset_3429c8ba.exe icq_rfrset_d7f1b325.exe icq_rfrset_40f4e3de.exe icq_rfrset_2c0fb08a.exe icq_rfrset_b8782c44.exe icq_rfrset_f28f7495.exe icq_rfrset_95f81537.exe icq_rfrset_501512a8.exe

This hash has been seen with multiple file names. Alternate names can appear when software is updated, copied between folders, packed by an installer, or deliberately renamed to avoid recognition. Compare the exact MD5 above before assuming two names refer to the same file.

Geographic signal

Observed country distribution

ThreatInfo has seen icq_rfrset_501512a8.exe across 25 countries. Use this signal to compare local evidence with where the sample is most often reported.

Top country Russian Federation
Share 54.8%
Low High activity

The strongest geographic signal for this file is Russian Federation with 54.8% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

OS Version:

Windows 10 52.2%
Windows 7 37.4%
Windows 8.1 9.6%
Windows XP 0.9%

The most common operating system signal for icq_rfrset_501512a8.exe is Windows 10 with 52.2% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

Analysis

icq_rfrset_501512a8.exe is identified as pe for 32-bit systems. The subsystem is Windows GUI. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Format pe
Architecture 32-bit
Subsystem Windows GUI
Entry point 0x000081b5
Image base 0x00400000

PE Sections:

Sections 5
Raw data 36520960

Section layout highlights raw-size concentration, repeated names, packer markers, and hashes that can be compared across related samples.

.text 128000 bytes · 0.4% of section data
MD5 109af149aa9971632e6d57aa09e96923
.rdata 58880 bytes · 0.2% of section data
MD5 c6da1a44d0a2710e87c54e30f9db1c5e
.data 3584 bytes · 0.0% of section data
MD5 f7773c1b641bbad04220f526fa90b1a7
.rsrc 36322304 bytes · 99.5% of section data
Large raw data
MD5 edc1f90647b4ee9ee304d978f3141f55
.reloc 8192 bytes · 0.0% of section data
MD5 89993aeb52ec133c468309032c6c81df

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

Report conclusion

GridinSoft detects this file as PUP.MailRu

This report identifies icq_rfrset_501512a8.exe by MD5 47c65cc1f9a839837894e5b465621fea. It is part of the PUP report group. If the same file is present on your device, scan the system and remove the detected object after confirming the hash and location.

Download GridinSoft Anti-Malware Scan the device and confirm whether this exact hash is present. Check this hash on VirusTotal

Recommended next steps

  • Compare the local file MD5 with 47c65cc1f9a839837894e5b465621fea.
  • Check the file path, publisher, and signature against the details in this report.
  • Run a GridinSoft scan and remove the object if the same hash is found. Use the PUP category to compare similar reports.