Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %PROGRAMDATA%\avg\icarus\logs\sfx.log.tmp.e741068c-8bd0-4b35-9e12-c0e762503027
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\icarus-info.xml
- %PROGRAMDATA%\avg\icarus\logs\icarus.log.tmp.44c5a418-0936-4a1c-8685-b8d7972f93cb
- %PROGRAMDATA%\avg\icarus\logs\icarus.log
- %PROGRAMDATA%\avg\icarus\logs\report.log
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\avg-bg\icarus.exe
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\avg-bg\icarus_ui.exe
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\avg-bg\dump_process.exe
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\common\7031184d-d44f-4f4b-a982-fe2b2d2b82c8
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\avg-bg\bug_report.exe
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\avg-bg\product-def.xml
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\avg-bg\setupui.cont
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\avg-bg\product-info.xml
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\avg-bg\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\common\setupui.cont
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\common\23bbab71-1909-466c-a811-f8b705c768c0
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\common\product-def.xml
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\common\6a0ea8a3-9d73-4898-bac3-a128aa1444ad
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\common\bug_report.exe
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\common\78f50a84-63c3-4d18-9f27-57faf2ad1537
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\common\dump_process.exe
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\common\4b937cc6-97da-4cad-8dc5-7428e1ec50a4
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\avg-bg\icarus_rvrt.exe
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\common\icarus_ui.exe
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\common\d0af6f9a-2f7c-4b80-b5dc-fe9e5ff0d9de
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\common\icarus.exe
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\common\4d6c570b-36e4-4a8d-a2d2-1c24f133be25
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\common\product-info.xml
- %WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\common\478f4d55-1f10-490a-bbb5-fd71a1a1bf92
- %PROGRAMDATA%\avg\icarus\logs\sfx.log
- %PROGRAMDATA%\avg\icarus\logs\sui.log.tmp.69e86875-efea-4042-8bf4-fa6527ecfc08
- %PROGRAMDATA%\avg\icarus\logs\sui.log
Moves the following files
- from %PROGRAMDATA%\avg\icarus\logs\sfx.log.tmp.e741068c-8bd0-4b35-9e12-c0e762503027 to %PROGRAMDATA%\avg\icarus\logs\sfx.log
- from %PROGRAMDATA%\avg\icarus\logs\icarus.log.tmp.44c5a418-0936-4a1c-8685-b8d7972f93cb to %PROGRAMDATA%\avg\icarus\logs\icarus.log
- from %PROGRAMDATA%\avg\icarus\logs\sui.log.tmp.69e86875-efea-4042-8bf4-fa6527ecfc08 to %PROGRAMDATA%\avg\icarus\logs\sui.log
Network activity
TCP
HTTP GET requests
- http://ho####.avcdn.net/dll/avg-bg/x86/icarus_mod.dll.lzma
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\icarus-info.xml /install
- '%WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\avg-bg\icarus.exe' /er_master:master_ep_d41dde41-9bcb-49ba-a782-f1a918f358e4 /er_ui:ui_ep_4c825287-01dc-4e77-a28b-6945721751ec /er_slave:avg-bg_slave_ep_c1c07892-232c-430b-9642-11e29dcc8fe2 /slave:avg-bg
- '%WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\common\icarus_ui.exe' /er_master:master_ep_d41dde41-9bcb-49ba-a782-f1a918f358e4 /er_ui:ui_ep_4c825287-01dc-4e77-a28b-6945721751ec
- '%WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\avg-bg\icarus.exe' /er_master:master_ep_d41dde41-9bcb-49ba-a782-f1a918f358e4 /er_ui:ui_ep_4c825287-01dc-4e77-a28b-6945721751ec /er_slave:avg-bg_slave_ep_c1c07892-232c-430b-9642-11e29dcc8fe2 /slave:avg-bg' (with hidden window)
- '%WINDIR%\temp\asw-998f5e78-7815-4653-95ef-9f22aac30274\common\icarus_ui.exe' /er_master:master_ep_d41dde41-9bcb-49ba-a782-f1a918f358e4 /er_ui:ui_ep_4c825287-01dc-4e77-a28b-6945721751ec' (with hidden window)
