Technical Information
Malicious functions
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\nsa4edb.tmp\aminsis.dll
- %LOCALAPPDATA%\google\chrome\user data\default\preferences
- %TEMP%\scoped_dir_2580_6132\crx_install\manifest.json
- %TEMP%\etilqs_1w7meut1jbxonmi
- %TEMP%\scoped_dir_2580_6132\videoplayerv3beta628.crx
- %TEMP%\79d1.tmp
- %TEMP%\etilqs_s4mqpmkipgph5rj
- %ProgramFiles(x86)%\videoplayerv3\videoplayerv3beta628\uninstall.exe
- %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\extensions.ini
- %ProgramFiles(x86)%\videoplayerv3\videoplayerv3beta628\ff\chrome\content\icons\default\videoplayerv3beta628_32.png
- %ProgramFiles(x86)%\videoplayerv3\videoplayerv3beta628\ff\chrome\content\overlay.xul
- %ProgramFiles(x86)%\videoplayerv3\videoplayerv3beta628\ff\chrome\content\ffvideoplayerv3beta628ffaction.js
- %ProgramFiles(x86)%\videoplayerv3\videoplayerv3beta628\ff\chrome\content\ffvideoplayerv3beta628.js
- %ProgramFiles(x86)%\videoplayerv3\videoplayerv3beta628\ff\install.rdf
- %ProgramFiles(x86)%\videoplayerv3\videoplayerv3beta628\ff\chrome.manifest
- %ProgramFiles(x86)%\videoplayerv3\videoplayerv3beta628\ch\videoplayerv3beta628.crx
- %ProgramFiles(x86)%\videoplayerv3\videoplayerv3beta628\ie\videoplayerv3beta628.dll
- %ProgramFiles(x86)%\videoplayerv3\videoplayerv3beta628\ff\chrome\content\icons\thumbs.db
- %TEMP%\aminsis.txt
Deletes the following files
- %TEMP%\79d1.tmp
- %TEMP%\scoped_dir_2580_6132\crx_install\icon.ico
- %TEMP%\scoped_dir_2580_6132\crx_install\images\videoplayerv3beta628_128.png
- %TEMP%\scoped_dir_2580_6132\crx_install\images\videoplayerv3beta628_16.png
- %TEMP%\scoped_dir_2580_6132\crx_install\images\videoplayerv3beta628_48.png
- %TEMP%\scoped_dir_2580_6132\decoded_images
- %TEMP%\scoped_dir_2580_6132\decoded_message_catalogs
- %TEMP%\scoped_dir_2580_6132\videoplayerv3beta628.crx
- %TEMP%\nsa4edb.tmp\aminsis.dll
Substitutes the following files
- %TEMP%\scoped_dir_2580_6132\crx_install\icon.ico
- %TEMP%\scoped_dir_2580_6132\crx_install\images\videoplayerv3beta628_128.png
- %TEMP%\scoped_dir_2580_6132\crx_install\images\videoplayerv3beta628_16.png
- %TEMP%\scoped_dir_2580_6132\crx_install\images\videoplayerv3beta628_48.png
Network activity
Connects to
- 'google.com':443
- 'tr######e.googleapis.com':443
- 'ss#.#static.com':443
- 'pk#.goog':80
TCP
HTTP GET requests
- http://pk#.goog/gsr1/gsr1.crt
Other
- 'google.com':443
- 'clients2.google.com':443
- 'tr######e.googleapis.com':443
- 'ss#.#static.com':443
- 'chrome.google.com':443
UDP
- DNS ASK google.com
- DNS ASK clients2.google.com
- DNS ASK clients4.google.com
- DNS ASK tr######e.googleapis.com
- DNS ASK clients3.google.com
- DNS ASK ss#.#static.com
- DNS ASK chrome.google.com
- DNS ASK pk#.goog
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\VideoPlayerV3\VideoPlayerV3beta628\ie\VideoPlayerV3beta628.dll" /s
- '%WINDIR%\syswow64\ctfmon.exe'
