Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\player] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\player] 'ImagePath' = '%PROGRAMDATA%\playersclub\LaunchServ.exe'
- [<HKLM>\System\CurrentControlSet\Services\PAExec] 'ImagePath' = '%WINDIR%\PaExec.exe -service'
Modifies file system
Creates the following files
- %WINDIR%\temp\pcdata\allprocesseslist.txt
- %PROGRAMDATA%\playersclub\allprocesseslist.txt
- %PROGRAMDATA%\playersclub\config.txt
- %PROGRAMDATA%\playersclub\cudart64_80.dll
- %PROGRAMDATA%\playersclub\launchserv.exe
- %PROGRAMDATA%\playersclub\launchserv.ini
- %PROGRAMDATA%\playersclub\libcurl-4.dll
- %PROGRAMDATA%\playersclub\libeay32.dll
- %PROGRAMDATA%\playersclub\libiconv-2.dll
- %PROGRAMDATA%\playersclub\libidn-11.dll
- %PROGRAMDATA%\playersclub\libintl-8.dll
- %PROGRAMDATA%\playersclub\libwinpthread-1.dll
- %PROGRAMDATA%\playersclub\msvcp140.dll
- %PROGRAMDATA%\playersclub\msvcr100.dll
- %PROGRAMDATA%\playersclub\paexec.exe
- %PROGRAMDATA%\playersclub\player.exe
- %PROGRAMDATA%\playersclub\player.txt
- %PROGRAMDATA%\playersclub\process.exe
- %PROGRAMDATA%\playersclub\processspawnlist.txt
- %PROGRAMDATA%\playersclub\pthreadvc2.dll
- %PROGRAMDATA%\playersclub\runprocesses.exe
- %PROGRAMDATA%\playersclub\showminer.bat
- %PROGRAMDATA%\playersclub\ssleay32.dll
- %PROGRAMDATA%\playersclub\systemspawn.exe
- %PROGRAMDATA%\playersclub\vcruntime140.dll
- %PROGRAMDATA%\playersclub\ver.txt
- %PROGRAMDATA%\playersclub\xmr-stak.exe
- %PROGRAMDATA%\playersclub\xmrstakconfig.txt
- %PROGRAMDATA%\playersclub\xmrstak_cuda_backend.dll
- %PROGRAMDATA%\playersclub\xmrstak_opencl_backend.dll
- %WINDIR%\temp\setup.exe
- %PROGRAMDATA%\playersclub\zlib1.dll
- %WINDIR%\temp\playerconfig.txt
- %WINDIR%\temp\icon.ico
- %WINDIR%\temp\pcdata\config.txt
- %WINDIR%\temp\pcdata\cudart64_80.dll
- %WINDIR%\temp\pcdata\launchserv.exe
- %WINDIR%\temp\pcdata\launchserv.ini
- %WINDIR%\temp\pcdata\libcurl-4.dll
- %WINDIR%\temp\pcdata\libeay32.dll
- %WINDIR%\temp\pcdata\libiconv-2.dll
- %WINDIR%\temp\pcdata\libidn-11.dll
- %WINDIR%\temp\pcdata\libintl-8.dll
- %WINDIR%\temp\pcdata\libwinpthread-1.dll
- %WINDIR%\temp\pcdata\msvcp140.dll
- %WINDIR%\temp\pcdata\msvcr100.dll
- %WINDIR%\temp\pcdata\paexec.exe
- %WINDIR%\temp\pcdata\player.exe
- %WINDIR%\temp\pcdata\player.txt
- %WINDIR%\temp\pcdata\process.exe
- %WINDIR%\temp\pcdata\processspawnlist.txt
- %WINDIR%\temp\pcdata\pthreadvc2.dll
- %WINDIR%\temp\pcdata\runprocesses.exe
- %WINDIR%\temp\pcdata\showminer.bat
- %WINDIR%\temp\pcdata\ssleay32.dll
- %WINDIR%\temp\pcdata\systemspawn.exe
- %WINDIR%\temp\pcdata\vcruntime140.dll
- %WINDIR%\temp\pcdata\ver.txt
- %WINDIR%\temp\pcdata\xmr-stak.exe
- %WINDIR%\temp\pcdata\xmrstakconfig.txt
- %WINDIR%\temp\pcdata\xmrstak_cuda_backend.dll
- %WINDIR%\temp\pcdata\xmrstak_opencl_backend.dll
- %WINDIR%\temp\pcdata\zlib1.dll
- %WINDIR%\temp\installer.exe
- %WINDIR%\paexec.exe
Deletes the following files
- %PROGRAMDATA%\playersclub\player.txt
- %WINDIR%\paexec.exe
Substitutes the following files
- %PROGRAMDATA%\playersclub\player.txt
Network activity
UDP
- DNS ASK mu#####yptominer.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'AutoHotkey' WindowName: '%PROGRAMDATA%\playersclub\systemspawn.exe'
- ClassName: 'AutoHotkey' WindowName: '%PROGRAMDATA%\playersclub\player.exe'
Creates and executes the following
- '%WINDIR%\temp\setup.exe'
- '%WINDIR%\temp\installer.exe'
- '%PROGRAMDATA%\playersclub\launchserv.exe' "-install"
- '%PROGRAMDATA%\playersclub\launchserv.exe' "-start"
- '%PROGRAMDATA%\playersclub\launchserv.exe'
- '%PROGRAMDATA%\playersclub\systemspawn.exe'
- '%PROGRAMDATA%\playersclub\paexec.exe' -s -x -d -i 0 %PROGRAMDATA%\playersclub\player.exe
- '%WINDIR%\paexec.exe' -service
- '%PROGRAMDATA%\playersclub\player.exe'
- '%PROGRAMDATA%\playersclub\launchserv.exe' "-install"' (with hidden window)
- '%PROGRAMDATA%\playersclub\launchserv.exe' "-start"' (with hidden window)
- '%PROGRAMDATA%\playersclub\paexec.exe' -s -x -d -i 0 %PROGRAMDATA%\playersclub\player.exe' (with hidden window)
