Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %PROGRAMDATA%\avg\icarus\logs\sfx.log.tmp.64c7eaa3-21b9-428b-ba3e-5a6f71b878a8
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\icarus-info.xml
- %PROGRAMDATA%\avg\icarus\logs\icarus.log.tmp.77cea738-78c3-4f2e-837e-da91ec3ab0ef
- %PROGRAMDATA%\avg\icarus\logs\icarus.log
- %PROGRAMDATA%\avg\icarus\logs\report.log
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\avg-tu\icarus.exe
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\avg-tu\icarus_product.dll
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\avg-tu\icarus_ui.exe
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\avg-tu\icarus_rvrt.exe
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\avg-tu\dump_process.exe
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\avg-tu\bug_report.exe
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\avg-tu\product-def.xml
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\avg-tu\setupui.cont
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\avg-tu\product-info.xml
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\avg-tu\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\common\setupui.cont
- %PROGRAMDATA%\avg\icarus\logs\sui.log.tmp.72337e03-490b-4271-837c-963dc26cc744
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\common\9d97bda4-d63f-4d79-9c15-3af87fcec0a0
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\common\474b4410-324b-4cfe-84c9-768c42daebb2
- %PROGRAMDATA%\avg\icarus\logs\sfx.log
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\common\23fa640d-72d2-435a-b805-53edf35265d1
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\common\product-info.xml
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\common\268360df-3b08-4044-8d4a-c96953e9c7f3
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\common\icarus.exe
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\common\399638ea-0a01-4db4-b2e8-2c7b0392a508
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\common\icarus_product.dll
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\common\4480fdc9-a9c0-46e1-9023-e315fbe1a96e
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\common\icarus_ui.exe
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\common\6a8bdbda-b14c-4d6a-a554-37b7eb68d5db
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\common\02ba2d30-21d8-417e-8360-4046d11a7d87
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\common\dump_process.exe
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\common\13b98f7f-8e21-475b-9138-910bd3ebbb1f
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\common\bug_report.exe
- %WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\common\product-def.xml
- %PROGRAMDATA%\avg\icarus\logs\sui.log
Moves the following files
- from %PROGRAMDATA%\avg\icarus\logs\sfx.log.tmp.64c7eaa3-21b9-428b-ba3e-5a6f71b878a8 to %PROGRAMDATA%\avg\icarus\logs\sfx.log
- from %PROGRAMDATA%\avg\icarus\logs\icarus.log.tmp.77cea738-78c3-4f2e-837e-da91ec3ab0ef to %PROGRAMDATA%\avg\icarus\logs\icarus.log
- from %PROGRAMDATA%\avg\icarus\logs\sui.log.tmp.72337e03-490b-4271-837c-963dc26cc744 to %PROGRAMDATA%\avg\icarus\logs\sui.log
Network activity
TCP
HTTP GET requests
- http://ho####.avcdn.net/dll/avg-tu/x86/icarus_mod.dll.lzma
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\icarus-info.xml /install
- '%WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\avg-tu\icarus.exe' /er_master:master_ep_d815240d-bbb6-4307-9ca4-f1766adc1a61 /er_ui:ui_ep_29b38b41-fd1b-46ae-a6b1-5ea91b98d147 /er_slave:avg-tu_slave_ep_3a1fcc74-d383-41cd-bd86-2a9286de4856 /slave:avg-tu
- '%WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\common\icarus_ui.exe' /er_master:master_ep_d815240d-bbb6-4307-9ca4-f1766adc1a61 /er_ui:ui_ep_29b38b41-fd1b-46ae-a6b1-5ea91b98d147
- '%WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\avg-tu\icarus.exe' /er_master:master_ep_d815240d-bbb6-4307-9ca4-f1766adc1a61 /er_ui:ui_ep_29b38b41-fd1b-46ae-a6b1-5ea91b98d147 /er_slave:avg-tu_slave_ep_3a1fcc74-d383-41cd-bd86-2a9286de4856 /slave:avg-tu' (with hidden window)
- '%WINDIR%\temp\asw-f1aa738d-f364-47df-b381-86a122cb477d\common\icarus_ui.exe' /er_master:master_ep_d815240d-bbb6-4307-9ca4-f1766adc1a61 /er_ui:ui_ep_29b38b41-fd1b-46ae-a6b1-5ea91b98d147' (with hidden window)
