home

rras.playpopgames.com

Moniker Online Services LLC (Done BUT Fraud Check)

Domain Information

The domain rras.playpopgames.com registered by Moniker Online Services LLC (Done BUT Fraud Check) was initially registered in April of 2015 through Moniker Online Services. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
Moniker Online Services

Server location:
Virginia, United States (US)

Create date:
Wednesday, April 1, 2015

Expires date:
Saturday, April 1, 2017

Updated date:
Monday, March 21, 2016

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.

Root domain:
playpopgames.com

Whois:
2 playpopgames.com records

Scanner detections:
Detections  (98% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.PlayPopGames.Installer.Meta (L), PUP.Downloader.PlayPopG.Installer.Meta (M), PUP.PlayPopGames (L)
97.56%

Microsoft Security Essentials
Worm:Win32/NeksMiner.A
2.44%

F-Secure
Application:W32/Generic.70053c248f!Online
2.44%

The domain rras.playpopgames.com has been seen to resolve to the following 3 IP addresses.

74.120.16.179
September 2, 2016

54.235.159.97
ec2-54-235-159-97.compute-1.amazonaws.com
June 25, 2016

174.34.141.58
174.34.141.58.rdns.as15003.net
October 26, 2015

File downloads found at URLs served by rras.playpopgames.com.

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/OTIwNDA5MTE4M9uhRSoNtLPDz9/.../PPGames.msi  (36cedb5d2dc1e7c0e0c16a2cfc6fbdd6)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTM0NTgwMTc3MDLboUUqDbSzw9PLdKA03qsKMwZzbBQI2VMGgyC NDaVRXKcXbjaZh7Ovwp8tsAxE1mxzh5udUBCB19HSUBXBK4YYUFBrYiIAGkeTBVpGgiAnrHPlPtDWaPcNfIePefGd/.../PPGames.msi  (5559ed0e8fa415a31c2363591adbe639)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTMwNTc3MjYwNDLboUUqDbSzw8/f3jjR/.../PPGames.msi  (05884307afb9c0d713a3db98ac43ff3e)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTM0MDUxMzIwMzDboUUqDbSzw8/f3jjR/.../PPGames.msi  (1db06dac3695538875ee78cadd0e0cae)

2 / 68      (false positives)
http://rras.playpopgames.com/pop/exe/YTE2ODkwMDU2NDjboUUqDbSzw9PLdKA03qsKMwZzbBQI2VN/DZMvADlS esGJsSuRCXLu7ZZJU8Arb4bOnf7jFFq//VrMRk7jncyqvLD18KlN7eq00NuPBtanK6Bu54zS1 PeGMVrfqZ1/.../PPGames.msi  (wrar420.exe)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/.../PPGames.msi  (15fb49d7394f8149719de6210efbe390)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTQwMjQyNTA4NzLboUUqDbSzw8/f3jjR/ffLtVdnR9IrJbfJuopUa 9L8I0anm31jN/.../PPGames.msi  (a8c53c8d4d7ed60703473320384ecc27)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/OTU4MDAwNjc4ONuhRSoNtLPDz9/eONH998u1V2dH0islt//HzbYqgMWX M5ylNI4TFCON7gYkmSw4hNctZt fis/.../PPGames.msi  (9793083ed91787bcf62e51427276a453)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/OTc0ODMwMjE4MtuhRSoNtLPDz9/eONH998tuXCpo5eq7Im3GYMveBE7el1 oOEIZCFtDExbYAcQQJBNctZt fis/muAH bYVcS0Bf3jk8CAEwowAeV2FkNbpzfcP3Jk4I4OlRYOijH /.../PPGames.msi  (ba9dfa437398a2967fa9810b52df513e)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/OTg1ODkyNzYwMtuhRSoNtLPD08t0oDTeqwozBnNsFAjZU4flYknFEda8SN4fGFeY6aS/1nGYxKAOz KOEoZYGafXhfChpjq5gHsarRpk2tyqlCsLn4OEo7UtqIORN8Dl8dHXKDnL/.../PPGames.msi  (6e05c55a43c7cf866351c40741394fd6)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTMyODMxNjk4MjHboUUqDbSzw8/f3jjR/.../PPGames.msi  (c050cf4bf15502e63aedecea1ea211f9)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTM0NjQwNDg3MjHboUUqDbSzw8/f3jjR/ffLtVdnR9IrJbeEt6Bk6ONCdsFO1Rvw1Fntd819ZnNgUiixzh5udUBCB8wz/oaK0yAxKU0DBiN5WvoHWevmN3DLBj/.../PPGames.msi  (e3767b16df694895ed2e6a9eb3768b74)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTM3NDM1NjAwNDbboUUqDbSzw8/f3jjR/ffLtVdnR9IrJbeEt6Bk6ONCdmn25yAy9LwUq/.../PPGames.msi  (666183496af1d59fdac6281cb0733e53)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTIxMzc0MDM5MDHboUUqDbSzw8/f3jjR/.../PPGames.msi  (6e3310f01c22da2091b313a7754cee16)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTQwMjQ1MTI3NDTboUUqDbSzw9PLdKA03qsKMwZzbBQI2VPvRNxarQZN/.../PPGames.msi  (8e6c9065e08f736e6aeddd54499655c7)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTIzMjI0MTMyMjDboUUqDbSzw8/f3jjR/ffLblwqaOXquyIB3M0/KZjPttDRNrHVbXpS00vy/5b0T7mxzh5udUBCB5T 8F7n2QnqMA46uulE7dkA60p9L/.../PPGames.msi  (1abffb155b753c8bd967ed34c1659415)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTQwOTMzOTEzMzTboUUqDbSzw8/f3jjR/.../PPGames.msi  (a87d9184865daab8e189a70e792c1182)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTE2OTM3OTExMDDboUUqDbSzw9PLdKA03qsKMwZzbBQI2VMotJuHAY3Df0rT0WaH/ww5Hb/.../PPGames.msi  (33705a1842e7aa3073cc9951b9e83c7c)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTE0MTQ4MDI5NzXboUUqDbSzw8/f3jjR/ffLXhIDIrKqIVXfFfXjrhmbvW9tKFGG r/4nLQnWnECHTCxzh5udUBCB/Zg2e/xyBHHzms1K5VHVdOOWAUKKdwiSi8SiQOEKx8TiqqoxU6yP/.../PPGames.msi  (ope.msi)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTMyOTc3ODQyNjLboUUqDbSzw8/f3jjR/ffLblwqaOXquyLYM5tyQf1CEjlxMZPG9FrFetBCNCGu0Umxzh5udUBCB0GVEHyI mvPU/7uUdn8yENv3iaCn1BUIcgIE/.../PPGames.msi  (c5d7ca4d3504bd365b461d24d9759c21)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTQyMTM1MTg0MTLboUUqDbSzw9PLdKA03qsKMwZzbBQI2VPn1s8kMbdVNK9ns8UHekiFo8IL/tItNQPijhKGWBmn17OV9SLCQLOv c9kFIeXzg5iAKrzH/nzzn xfXCiD1TkueYI/.../PPGames.msi  (1f9bd87ca47469249036145ba0266484)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTI5NTExNjQ2NDDboUUqDbSzw8/f3jjR/ffLXhIDIrKqIVUuYKmnZGwIIW3Qjtkbaqvke6f86cK5w YTXLWbfn4rP9k/ig1VyafUCeRymHzy/Ll3yq86bwqUeTgm6/kfRlJ45DRURf/.../PPGames.msi  (8e848e01db872320f6dd318c4e211a32)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTIyMzAzOTkwODPboUUqDbSzw8/f3jjR/.../PPGames.msi  (82c20752db198658f5cc27a41a914fa7)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/OTcxNzgyODA4N9uhRSoNtLPDz9/eONH998u1V2dH0islt g6oDRlXxmdIyPu7igBUkrrcj5VfIRaSLHOHm51QEIHLfGrNmg5U2K8HpXE0/By4zZRBD6Tt/.../PPGames.msi  (944eac609510b50c027553fb7d6ae63f)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTI1OTAzMjI2MTHboUUqDbSzw8/f3jjR/ffLtVdnR9IrJbfoOqA0ZV8ZnfkvdGQgmDXHfHZ7/kTP/.../PPGames.msi  (45ba890a9f2a2b7228957cf20d2d0e7e)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTEzMzc3MzQwMDQOnptx2cRZHluku9q6hl5vIo91w9DTF3YSLAQDPwLrKW5tzQU92ZwOtQCpJ12m0c8Rqe4NNtUkt4znkwW8ndxJ8KNXGk1rdf0jQwdaUSjJfxV8NeixDVLvOwgztd15DHuuYQUTvsRwiXr7Io/.../PPGames.exe  (9e9b4d1ce19040fd83cd790c7d61994c)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTExODMyNjQ4NDTboUUqDbSzw8/f3jjR/ffLXhIDIrKqIVVkuqzAUWrJIZW8Gu2gdCbhAYRjQZCIgUETXLWbfn4rPzcRzbUj5OaZWHflyswaR4itereoeia3PBehCG7rTI/dIiZsqN/.../PPGames.msi  (26a50ea8a261d3676e77aefb6e7be2c4)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTM2NTI3Mjk0MjlX0pzR/2xp i 0XJNeeNO4q63o1WctD/QIlBGgAW/nt1v8M6EbJXhZN6rCdyBpja4uy6liFmQ9M7u2 irrshaTtmiHB6IdoDaOY6r8HfrD8eHhM57UsUh2FgTpPeRn/.../PPGames.exe  (9e9b4d1ce19040fd83cd790c7d61994c)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTE4OTM2NzQ0ODHboUUqDbSzw9PLdKA03qsKMwZzbBQI2VNWFvQOInPmx/o3YWOS86LyK1MfCKZErugTXLWbfn4rPzepENAHgLFpXSMlCE/.../PPGames.msi  (a35b729b87ef696583d3c8d5d6d7652b)

1 / 68      (PUP)
http://rras.playpopgames.com/pop/exe/YTE0NTc0MDQxMjXboUUqDbSzw0 PgPoB6Z M8Rj2cRXo1EVssuCkAAK7N39E /YHEWSOcFZMhyDQ0EIHbugcVQii6BgnBSr/chSdjUkwluGBdHnjq6mM61Ens53l68hU5hSI6rU3/.../PPGames.exe  (9e9b4d1ce19040fd83cd790c7d61994c)

 
Latest 30 of 238 download URLs

The following 7 files have been seen to comunicate with rras.playpopgames.com in live environments.

TCP » 54.235.159.97:80
videoperformersetup.exe (Installer)

TCP » 54.235.159.97:80
videoperformersetup.exe (Installer)

TCP » 54.235.159.97:80
CodecPerformerSetup.exe (CodecPerformer)

TCP » 54.235.159.97:80
codecperformersetup.exe (Installer)

TCP » 54.235.159.97:80
bestcodecspacksetup.exe (Installer)

TCP » 54.235.159.97:80
CodecPerformerSetup.exe (CodecPerformer)

TCP » 54.235.159.97:80
curl.exe (The cURL executable by cURL, http://curl.haxx.se/)

URL:
http://rras.playpopgames.com/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.