Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\Software\Classes\playkey\shell\open\command] '' = '"%ProgramFiles(x86)%\Playkey\Playkey.exe" "%1"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'PlaykeyOffers' = '%ProgramFiles(x86)%\Playkey\PlaykeyOffers.exe'
Вредоносные функции
Запускает на исполнение
- '<SYSTEM32>\taskkill.exe' /f /im "PlaykeyOffers.exe"
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\is-jtg4g.tmp\<Имя файла>.tmp
- %ProgramFiles(x86)%\playkey\is-jjfvu.tmp
- %ProgramFiles(x86)%\playkey\is-u0vm0.tmp
- %ProgramFiles(x86)%\playkey\is-6s1kl.tmp
- %ProgramFiles(x86)%\playkey\is-e8ppl.tmp
- %ProgramFiles(x86)%\playkey\is-8im8g.tmp
- %ProgramFiles(x86)%\playkey\is-9h5fg.tmp
- %ProgramFiles(x86)%\playkey\is-rukt2.tmp
- %ProgramFiles(x86)%\playkey\is-psc1u.tmp
- %ProgramFiles(x86)%\playkey\is-dsu4s.tmp
- %ProgramFiles(x86)%\playkey\is-kmg9p.tmp
- %ProgramFiles(x86)%\playkey\is-7e907.tmp
- %ProgramFiles(x86)%\playkey\is-f5muo.tmp
- %ProgramFiles(x86)%\playkey\is-331ka.tmp
- %ProgramFiles(x86)%\playkey\is-antb2.tmp
- %ProgramFiles(x86)%\playkey\is-vsvrv.tmp
- %ProgramFiles(x86)%\playkey\is-qu0no.tmp
- %ProgramFiles(x86)%\playkey\is-lgnr0.tmp
- C:\users\public\desktop\playkey.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\playkey\go to playkey.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\playkey\uninstall playkey.lnk
- %ProgramFiles(x86)%\playkey\sounds\is-j0tf2.tmp
- %ProgramFiles(x86)%\playkey\icons\is-lfv6k.tmp
- %ProgramFiles(x86)%\playkey\icons\is-dq9s0.tmp
- %ProgramFiles(x86)%\playkey\icons\is-iucf4.tmp
- %ProgramFiles(x86)%\playkey\icons\is-kf2gp.tmp
- %ProgramFiles(x86)%\playkey\icons\is-lh8bi.tmp
- %ProgramFiles(x86)%\playkey\icons\is-ki4bv.tmp
- %ProgramFiles(x86)%\playkey\is-7ccet.tmp
- %ProgramFiles(x86)%\playkey\platforms\is-mefhb.tmp
- %ProgramFiles(x86)%\playkey\is-1cb09.tmp
- %ProgramFiles(x86)%\playkey\is-17drt.tmp
- %ProgramFiles(x86)%\playkey\is-g4g53.tmp
- %ProgramFiles(x86)%\playkey\is-ufe2m.tmp
- %ProgramFiles(x86)%\playkey\is-72q4g.tmp
- %ProgramFiles(x86)%\playkey\is-1m58l.tmp
- %ProgramFiles(x86)%\playkey\is-uq3a3.tmp
- %ProgramFiles(x86)%\playkey\is-vfhtk.tmp
- %ProgramFiles(x86)%\playkey\is-m6mcn.tmp
- %ProgramFiles(x86)%\playkey\is-2ra9m.tmp
- %ProgramFiles(x86)%\playkey\is-65kie.tmp
- %ProgramFiles(x86)%\playkey\is-8lfvl.tmp
- %ProgramFiles(x86)%\playkey\is-drddh.tmp
- %ProgramFiles(x86)%\playkey\is-8i4ii.tmp
- %ProgramFiles(x86)%\playkey\is-2hk0q.tmp
- %ProgramFiles(x86)%\playkey\is-6iq7v.tmp
- %ProgramFiles(x86)%\playkey\is-vajfl.tmp
- %ProgramFiles(x86)%\playkey\is-v75jl.tmp
- %ProgramFiles(x86)%\playkey\is-4adgr.tmp
- %ProgramFiles(x86)%\playkey\is-86ma4.tmp
- %ProgramFiles(x86)%\playkey\is-tcdlk.tmp
- %ProgramFiles(x86)%\playkey\is-b8l26.tmp
- %TEMP%\is-q3k6o.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\playkey\unins000.msg
- %ProgramFiles(x86)%\playkey\is-iavvv.tmp
- %ProgramFiles(x86)%\playkey\is-n0p5f.tmp
- %ProgramFiles(x86)%\playkey\is-2k9tg.tmp
- %ProgramFiles(x86)%\playkey\is-c1os5.tmp
- %ProgramFiles(x86)%\playkey\is-mj1oj.tmp
- %ProgramFiles(x86)%\playkey\is-0276e.tmp
- %ProgramFiles(x86)%\playkey\is-188de.tmp
- %ProgramFiles(x86)%\playkey\is-fddfm.tmp
- %ProgramFiles(x86)%\playkey\is-mc2b6.tmp
- %ProgramFiles(x86)%\playkey\is-vae0b.tmp
- %ProgramFiles(x86)%\playkey\is-b6ipk.tmp
- %ProgramFiles(x86)%\playkey\is-qarjh.tmp
- %ProgramFiles(x86)%\playkey\is-so3np.tmp
- %ProgramFiles(x86)%\playkey\is-l3s2l.tmp
- %ProgramFiles(x86)%\playkey\is-87qtt.tmp
- %ProgramFiles(x86)%\playkey\is-kv5vd.tmp
- %ProgramFiles(x86)%\playkey\is-lmpfh.tmp
- %ProgramFiles(x86)%\playkey\is-l36tk.tmp
- %ProgramFiles(x86)%\playkey\is-m56dg.tmp
- %ProgramFiles(x86)%\playkey\unins000.dat
Перемещает следующие файлы
- %ProgramFiles(x86)%\playkey\is-b8l26.tmp в %ProgramFiles(x86)%\playkey\unins000.exe
- %ProgramFiles(x86)%\playkey\is-1m58l.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-crt-conio-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-ufe2m.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-crt-convert-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-antb2.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-crt-environment-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-331ka.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-crt-filesystem-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-f5muo.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-crt-heap-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-7e907.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-crt-locale-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-kmg9p.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-crt-math-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-dsu4s.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-crt-multibyte-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-72q4g.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-crt-private-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-vsvrv.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-crt-process-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-9h5fg.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-crt-runtime-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-8im8g.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-crt-stdio-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-e8ppl.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-crt-string-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-6s1kl.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-crt-time-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-jjfvu.tmp в %ProgramFiles(x86)%\playkey\msvcp140.dll
- %ProgramFiles(x86)%\playkey\icons\is-lfv6k.tmp в %ProgramFiles(x86)%\playkey\icons\wot.ico
- %ProgramFiles(x86)%\playkey\is-psc1u.tmp в %ProgramFiles(x86)%\playkey\ucrtbase.dll
- %ProgramFiles(x86)%\playkey\is-rukt2.tmp в %ProgramFiles(x86)%\playkey\vcruntime140.dll
- %ProgramFiles(x86)%\playkey\is-lgnr0.tmp в %ProgramFiles(x86)%\playkey\qt5core.dll
- %ProgramFiles(x86)%\playkey\is-iavvv.tmp в %ProgramFiles(x86)%\playkey\qt5gui.dll
- %ProgramFiles(x86)%\playkey\is-g4g53.tmp в %ProgramFiles(x86)%\playkey\qt5widgets.dll
- %ProgramFiles(x86)%\playkey\is-17drt.tmp в %ProgramFiles(x86)%\playkey\qt5network.dll
- %ProgramFiles(x86)%\playkey\is-1cb09.tmp в %ProgramFiles(x86)%\playkey\qt5xml.dll
- %ProgramFiles(x86)%\playkey\platforms\is-mefhb.tmp в %ProgramFiles(x86)%\playkey\platforms\qwindows.dll
- %ProgramFiles(x86)%\playkey\is-7ccet.tmp в %ProgramFiles(x86)%\playkey\playkeyoffers.exe
- %ProgramFiles(x86)%\playkey\icons\is-ki4bv.tmp в %ProgramFiles(x86)%\playkey\icons\dota2.ico
- %ProgramFiles(x86)%\playkey\icons\is-lh8bi.tmp в %ProgramFiles(x86)%\playkey\icons\fortnite.ico
- %ProgramFiles(x86)%\playkey\icons\is-kf2gp.tmp в %ProgramFiles(x86)%\playkey\icons\gta5.ico
- %ProgramFiles(x86)%\playkey\icons\is-iucf4.tmp в %ProgramFiles(x86)%\playkey\icons\pubg.ico
- %ProgramFiles(x86)%\playkey\icons\is-dq9s0.tmp в %ProgramFiles(x86)%\playkey\icons\witcher3.ico
- %ProgramFiles(x86)%\playkey\is-uq3a3.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-util-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-u0vm0.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-crt-utility-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-vfhtk.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-timezone-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-n0p5f.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-file-l1-2-0.dll
- %ProgramFiles(x86)%\playkey\is-tcdlk.tmp в %ProgramFiles(x86)%\playkey\playkey.exe
- %ProgramFiles(x86)%\playkey\is-86ma4.tmp в %ProgramFiles(x86)%\playkey\playkeyupdater.exe
- %ProgramFiles(x86)%\playkey\is-4adgr.tmp в %ProgramFiles(x86)%\playkey\crashpad_handler.exe
- %ProgramFiles(x86)%\playkey\is-v75jl.tmp в %ProgramFiles(x86)%\playkey\libeay32.dll
- %ProgramFiles(x86)%\playkey\is-6iq7v.tmp в %ProgramFiles(x86)%\playkey\ssleay32.dll
- %ProgramFiles(x86)%\playkey\is-m6mcn.tmp в %ProgramFiles(x86)%\playkey\openal32.dll
- %ProgramFiles(x86)%\playkey\is-2hk0q.tmp в %ProgramFiles(x86)%\playkey\wrap_oal.dll
- %ProgramFiles(x86)%\playkey\is-8i4ii.tmp в %ProgramFiles(x86)%\playkey\xinput1_3.dll
- %ProgramFiles(x86)%\playkey\is-drddh.tmp в %ProgramFiles(x86)%\playkey\amfrt32.dll
- %ProgramFiles(x86)%\playkey\is-8lfvl.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-console-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-65kie.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-datetime-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-2ra9m.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-debug-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-c1os5.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-errorhandling-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-vajfl.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-file-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-qu0no.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-file-l2-1-0.dll
- %ProgramFiles(x86)%\playkey\is-0276e.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-synch-l1-2-0.dll
- %ProgramFiles(x86)%\playkey\is-m56dg.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-handle-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-2k9tg.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-heap-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-l36tk.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-interlocked-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-lmpfh.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-libraryloader-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-kv5vd.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-localization-l1-2-0.dll
- %ProgramFiles(x86)%\playkey\is-87qtt.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-memory-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-l3s2l.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-namedpipe-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-so3np.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-processenvironment-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-qarjh.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-processthreads-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-b6ipk.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-processthreads-l1-1-1.dll
- %ProgramFiles(x86)%\playkey\is-vae0b.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-profile-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-mc2b6.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-rtlsupport-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-fddfm.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-string-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-188de.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-synch-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\is-mj1oj.tmp в %ProgramFiles(x86)%\playkey\api-ms-win-core-sysinfo-l1-1-0.dll
- %ProgramFiles(x86)%\playkey\sounds\is-j0tf2.tmp в %ProgramFiles(x86)%\playkey\sounds\start.wav
Сетевая активность
TCP
- 'ss#.####le-analytics.com':443
UDP
- DNS ASK ss#.####le-analytics.com
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\is-jtg4g.tmp\<Имя файла>.tmp' /SL5="$B01E8,17154200,216064,<Полный путь к файлу>"
- '<SYSTEM32>\taskkill.exe' /f /im "PlaykeyOffers.exe"' (со скрытым окном)
