One part you glossed over. If it's taking login/passwords, where is it sending them to? That would be the first thing I'd look at when tracking down who created it. Russian/Chinese/US?