Technical Information
Malicious functions
Injects code into
the following user processes:
- chrome.exe
Modifies file system
Creates the following files
- %TEMP%\playbryte-fa-cb_playbryte-fa-cb_install.zip
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\chrome\content\share_link.xul
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\chrome\content\menu.xul
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\chrome\content\login.xul
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\chrome\content\json.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\chrome\content\fileio.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\chrome\content\browserwindow.xul
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\chrome\content\browserwindow.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\toolbar.xml
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\install.rdf
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\ffaboutblanksearch.txt
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\chrome.manifest
- %LOCALAPPDATA%low\playbryte\chrome.crx
- %TEMP%\scoped_dir3064_343\extension.zip
- %LOCALAPPDATA%low\playbryte\chrome.pem
- %LOCALAPPDATA%low\playbryte\settings\updatersettings.xml
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\chrome\content\sidebar.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\chrome\content\thumbs.db
- %LOCALAPPDATA%\applicationhistory\<File name>.exe.dd390cd8.ini
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\chrome\content\toolbar.js
- %LOCALAPPDATA%low\playbryte\install.log
- %ProgramFiles(x86)%\playbryte\uninstall.exe
- %WINDIR%\assembly\tmp\mnopqrst\__assemblyinfo__.ini
- %WINDIR%\assembly\tmp\mnopqrst\shdocvw.dll
- %LOCALAPPDATA%\fusioncache.dat
- %WINDIR%\assembly\tmp\defghijk\__assemblyinfo__.ini
- %WINDIR%\assembly\tmp\defghijk\axshdocvw.dll
- %LOCALAPPDATA%low\playbryte\usersettings.xml
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\chrome\content\settingsconfig.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\chrome\content\inline\inline.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\chrome\content\images\hidden.png
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\chrome\content\windows.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\chrome\content\update_status.xul
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\chrome\content\toolbarsidebarshared.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\chrome\content\toolbar.xul
- %LOCALAPPDATA%low\playbryte\settings\toolbarprefs.txt
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\playbryte@playbryte.com\chrome\content\sidebar.xul
- %LOCALAPPDATA%low\playbryte\gac\shdocvw.dll
- %LOCALAPPDATA%low\playbryte\firefox\playbryte@playbryte.com\chrome\content\browserwindow.xul
- %LOCALAPPDATA%low\playbryte\firefox\playbryte@playbryte.com\chrome.manifest
- %LOCALAPPDATA%low\playbryte\chrome\settingsconfig.json
- %LOCALAPPDATA%low\playbryte\chrome\manifest.json
- %LOCALAPPDATA%low\playbryte\chrome\inline_content.js
- %LOCALAPPDATA%low\playbryte\chrome\bg.js
- %LOCALAPPDATA%low\playbryte\assemblies\1\inline.dll
- %LOCALAPPDATA%low\playbryte\assemblies\1\browserobjects.dll
- %LOCALAPPDATA%low\playbryte\version.txt
- %LOCALAPPDATA%low\playbryte\toolbar.xml
- %LOCALAPPDATA%low\playbryte\tabssearch.txt
- %LOCALAPPDATA%low\playbryte\desktop.xml
- %LOCALAPPDATA%low\playbryte\config.json
- %LOCALAPPDATA%low\playbryte\config.cfg
- %LOCALAPPDATA%low\playbryte\bho.xml
- %LOCALAPPDATA%low\playbryte\authorizedurls.xml
- %LOCALAPPDATA%low\playbryte\firefox\playbryte@playbryte.com\chrome\content\browserwindow.js
- %LOCALAPPDATA%low\playbryte\firefox\playbryte@playbryte.com\chrome\content\fileio.js
- %LOCALAPPDATA%low\playbryte\firefox\playbryte@playbryte.com\toolbar.xml
- %LOCALAPPDATA%low\playbryte\firefox\playbryte@playbryte.com\chrome\content\images\hidden.png
- %LOCALAPPDATA%low\playbryte\firefox\playbryte@playbryte.com\install.rdf
- %LOCALAPPDATA%low\playbryte\firefox\playbryte@playbryte.com\ffaboutblanksearch.txt
- %LOCALAPPDATA%low\playbryte\firefox\playbryte@playbryte.com\chrome\content\windows.js
- %LOCALAPPDATA%low\playbryte\firefox\playbryte@playbryte.com\chrome\content\update_status.xul
- %LOCALAPPDATA%low\playbryte\firefox\playbryte@playbryte.com\chrome\content\toolbarsidebarshared.js
- %LOCALAPPDATA%low\playbryte\firefox\playbryte@playbryte.com\chrome\content\toolbar.xul
- %LOCALAPPDATA%low\playbryte\firefox\playbryte@playbryte.com\chrome\content\toolbar.js
- %LOCALAPPDATA%low\playbryte\firefox\playbryte@playbryte.com\chrome\content\thumbs.db
- %LOCALAPPDATA%low\playbryte\firefox\playbryte@playbryte.com\chrome\content\sidebar.xul
- %LOCALAPPDATA%low\playbryte\firefox\playbryte@playbryte.com\chrome\content\sidebar.js
- %LOCALAPPDATA%low\playbryte\firefox\playbryte@playbryte.com\chrome\content\share_link.xul
- %LOCALAPPDATA%low\playbryte\firefox\playbryte@playbryte.com\chrome\content\menu.xul
- %LOCALAPPDATA%low\playbryte\firefox\playbryte@playbryte.com\chrome\content\login.xul
- %LOCALAPPDATA%low\playbryte\firefox\playbryte@playbryte.com\chrome\content\json.js
- %LOCALAPPDATA%low\playbryte\firefox\playbryte@playbryte.com\chrome\content\inline\inline.js
- %LOCALAPPDATA%low\playbryte\gac\axshdocvw.dll
- nul
Deletes the following files
- %TEMP%\scoped_dir3064_343\extension.zip
- %TEMP%\playbryte-fa-cb_playbryte-fa-cb_install.zip
Deletes itself.
Network activity
UDP
- DNS ASK im##############y-1085035873.us-east-1.elb.amazonaws.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del <Full path to file>' (with hidden window)
Executes the following
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --pack-extension="%LOCALAPPDATA%Low\Playbryte\Chrome" --no-message-box
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=gpu-process --channel="3064.0.1741791073\685289587" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-device-id=0x0000 --gpu-driver-vendor --gp...
- '%WINDIR%\syswow64\cmd.exe' /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del <Full path to file>
- '%WINDIR%\syswow64\ping.exe' 1.1.1.1 -n 1 -w 3000
