Read my other posts, you may learn something. Only space has kept me from being more detailed. When I ran malware after penetrating my target I'd take everything I wanted including passwords. I'd uninstall the trojan leaving no tracks and then log in as a legitimate user using an IP from the same country so as not to trip any alarms from the administrator. If I was to do something seriously criminal I'd go to another city or country and even if my work could be traced back to a particular location it wouldn't matter. If we assume that the IP location is correct then a Russian ran the inferior, obsolete Ukrainian software that guaranteed detection. Consider that they could have downloaded Chinese malware, since they don't have the skills and resources to create their own software, :)  and then made sure that forensic analysis showed a Chinese origin, perhaps run it from Hong Kong to be safe. We can accuse the Russians of many things and be right but incompetence isn't one of them.