Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.affc21e7-8d53-4a7a-b328-c36e5c311c1a
- %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.a85c1732-491b-4a46-b951-d036b4e88ad8
- %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
- %ALLUSERSPROFILE%\avast software\icarus\logs\report.log
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\avast-tu\icarus.exe
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\avast-tu\icarus_product.dll
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\avast-tu\icarus_ui.exe
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\common\icarus_ui.exe
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\avast-tu\icarus_rvrt.exe
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\avast-tu\bug_report.exe
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\avast-tu\product-def.xml
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\avast-tu\setupui.cont
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\avast-tu\product-info.xml
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\avast-tu\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\trid.edat
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\icarus-info.xml
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\common\setupui.cont
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\common\4d3b6164-b44f-4b68-9acd-84cc50bee93b
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\common\product-def.xml
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\common\7fa57575-a4b2-4010-83b0-593f18c25c16
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\common\product-info.xml
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\common\193c591c-06b7-465c-9b9a-df64387b5728
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\common\icarus.exe
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\common\22f95352-fd50-4a52-933e-b73bf58c159d
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\common\icarus_product.dll
- %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.cbf98797-d585-42b9-8833-d8107c7d82a6
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\avast-tu\dump_process.exe
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\common\8341aa8a-5d99-41a0-bf8d-98e233a449e8
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\common\d26aa4ba-2b0b-437c-80db-0348ded14436
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\common\dump_process.exe
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\common\0d9a6a2b-0df1-47e1-9c20-f90fd4ac0ccb
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\common\bug_report.exe
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\common\3c8d6d55-073b-4d38-909b-087ce1e2a22e
- %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
- %WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\common\010ebfc2-f29c-458e-9d3f-9f224731dd2a
- %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log
Moves the following files
- from %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.affc21e7-8d53-4a7a-b328-c36e5c311c1a to %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
- from %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.a85c1732-491b-4a46-b951-d036b4e88ad8 to %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
- from %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.cbf98797-d585-42b9-8833-d8107c7d82a6 to %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log
Network activity
TCP
HTTP GET requests
- http://ho####.avcdn.net/dll/avast-tu/x86/icarus_mod.dll.lzma
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\icarus-info.xml /install
- '%WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\avast-tu\icarus.exe' /er_master:master_ep_18880f05-9ce1-4cd2-8ad7-f50b4b563fde /er_ui:ui_ep_5f8293ab-c0a5-4edb-bb81-e36c2ad690bd /er_slave:avast-tu_slave_ep_850fc9cb-d97a-4a43-93eb-80cb603588d6 /slave:avast-tu
- '%WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\common\icarus_ui.exe' /er_master:master_ep_18880f05-9ce1-4cd2-8ad7-f50b4b563fde /er_ui:ui_ep_5f8293ab-c0a5-4edb-bb81-e36c2ad690bd
- '%WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\avast-tu\icarus.exe' /er_master:master_ep_18880f05-9ce1-4cd2-8ad7-f50b4b563fde /er_ui:ui_ep_5f8293ab-c0a5-4edb-bb81-e36c2ad690bd /er_slave:avast-tu_slave_ep_850fc9cb-d97a-4a43-93eb-80cb603588d6 /slave:avast-tu' (with hidden window)
- '%WINDIR%\temp\asw-a31a4a31-190d-43a9-935a-c967df147e63\common\icarus_ui.exe' /er_master:master_ep_18880f05-9ce1-4cd2-8ad7-f50b4b563fde /er_ui:ui_ep_5f8293ab-c0a5-4edb-bb81-e36c2ad690bd' (with hidden window)
