Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %PROGRAMDATA%\avast software\icarus\logs\sfx.log.tmp.142a021b-97ea-43f5-a48f-5a5f4f5b27b9
- %PROGRAMDATA%\avast software\icarus\logs\icarus.log.tmp.a76fc5d8-f24c-4440-a3c1-a84990264dfb
- %PROGRAMDATA%\avast software\icarus\logs\icarus.log
- %PROGRAMDATA%\avast software\icarus\logs\report.log
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\avast-tu\icarus.exe
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\avast-tu\icarus_product.dll
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\avast-tu\icarus_ui.exe
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\common\icarus_ui.exe
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\avast-tu\icarus_rvrt.exe
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\avast-tu\bug_report.exe
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\avast-tu\product-def.xml
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\avast-tu\setupui.cont
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\avast-tu\product-info.xml
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\avast-tu\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\trid.edat
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\icarus-info.xml
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\common\setupui.cont
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\common\43ee9aaf-0a3c-47d5-9de8-480925349708
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\common\product-def.xml
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\common\dd925d43-fa65-4338-bdbf-a51e25d64205
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\common\product-info.xml
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\common\b09cbdd5-7ba5-4331-a324-fae8408281ae
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\common\icarus.exe
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\common\ade271ff-dd53-4c8e-8cf9-ed32543d2ae1
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\common\icarus_product.dll
- %PROGRAMDATA%\avast software\icarus\logs\sui.log.tmp.f619efe2-e88f-4f04-ad3f-2e33ce4d8d89
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\avast-tu\dump_process.exe
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\common\61626a14-45d5-46a6-afc7-66f18b3d470a
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\common\2e4d7c9b-e491-45fc-b851-5d9be5ae659e
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\common\dump_process.exe
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\common\27f4dc32-acd8-4815-9ba6-3424ce8a8f60
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\common\bug_report.exe
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\common\f8f5e09b-535f-4ad3-a46b-1bde64e7d162
- %PROGRAMDATA%\avast software\icarus\logs\sfx.log
- %WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\common\6d14eaa1-d10f-4a4a-9860-3e3e3fdc3def
- %PROGRAMDATA%\avast software\icarus\logs\sui.log
Moves the following files
- from %PROGRAMDATA%\avast software\icarus\logs\sfx.log.tmp.142a021b-97ea-43f5-a48f-5a5f4f5b27b9 to %PROGRAMDATA%\avast software\icarus\logs\sfx.log
- from %PROGRAMDATA%\avast software\icarus\logs\icarus.log.tmp.a76fc5d8-f24c-4440-a3c1-a84990264dfb to %PROGRAMDATA%\avast software\icarus\logs\icarus.log
- from %PROGRAMDATA%\avast software\icarus\logs\sui.log.tmp.f619efe2-e88f-4f04-ad3f-2e33ce4d8d89 to %PROGRAMDATA%\avast software\icarus\logs\sui.log
Network activity
TCP
HTTP GET requests
- http://ho####.avcdn.net/dll/avast-tu/x86/icarus_mod.dll.lzma
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\icarus-info.xml /install
- '%WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\avast-tu\icarus.exe' /er_master:master_ep_e949b81c-9f78-4048-836a-ed09d08de853 /er_ui:ui_ep_dbe0f08a-f87f-479a-90e6-adcae324dbab /er_slave:avast-tu_slave_ep_6d6a8ef7-716f-43d1-a41f-6774a08f1d14 /slave:avast-tu
- '%WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\common\icarus_ui.exe' /er_master:master_ep_e949b81c-9f78-4048-836a-ed09d08de853 /er_ui:ui_ep_dbe0f08a-f87f-479a-90e6-adcae324dbab
- '%WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\avast-tu\icarus.exe' /er_master:master_ep_e949b81c-9f78-4048-836a-ed09d08de853 /er_ui:ui_ep_dbe0f08a-f87f-479a-90e6-adcae324dbab /er_slave:avast-tu_slave_ep_6d6a8ef7-716f-43d1-a41f-6774a08f1d14 /slave:avast-tu' (with hidden window)
- '%WINDIR%\temp\asw-9820d518-0938-4898-b4dc-f91c4e3a1914\common\icarus_ui.exe' /er_master:master_ep_e949b81c-9f78-4048-836a-ed09d08de853 /er_ui:ui_ep_dbe0f08a-f87f-479a-90e6-adcae324dbab' (with hidden window)
