Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.ac6fcc50-f3eb-48db-b0e9-85aa9d0754fe
- %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.d08a7d82-7591-4ed8-be65-d2599ebb5bd0
- %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
- %ALLUSERSPROFILE%\avast software\icarus\logs\report.log
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\avast-du\icarus.exe
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\avast-du\icarus_product.dll
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\avast-du\icarus_ui.exe
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\common\icarus_ui.exe
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\avast-du\icarus_rvrt.exe
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\avast-du\bug_report.exe
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\avast-du\product-def.xml
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\avast-du\setupui.cont
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\avast-du\product-info.xml
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\avast-du\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\trid.edat
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\icarus-info.xml
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\common\setupui.cont
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\common\59519682-fbf7-495b-b0c1-8978711e7161
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\common\product-def.xml
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\common\880a2dec-324d-45c9-8441-18b3c8027b2d
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\common\product-info.xml
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\common\56cae5de-55eb-4da4-8244-f00927fbf5ef
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\common\icarus.exe
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\common\62e13bd2-a2a1-4eed-9b2d-82707ca60667
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\common\icarus_product.dll
- %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.f1c91c7a-22f6-4df8-85a8-a5699ddb0c91
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\avast-du\dump_process.exe
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\common\c2f7e620-9d72-4395-9a55-b2287324d55c
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\common\ef560e8e-93b9-48ff-908a-45fabbef28ed
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\common\dump_process.exe
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\common\57d9f716-879d-49e8-a43a-de2f2d1edd75
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\common\bug_report.exe
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\common\9c5b9ff0-d0ad-4910-ab29-167e517d025f
- %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
- %WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\common\65c75b56-133b-4035-ae22-f9a7a9f04935
- %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log
Moves the following files
- from %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.ac6fcc50-f3eb-48db-b0e9-85aa9d0754fe to %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
- from %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.d08a7d82-7591-4ed8-be65-d2599ebb5bd0 to %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
- from %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.f1c91c7a-22f6-4df8-85a8-a5699ddb0c91 to %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log
Network activity
Connects to
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'ho####.avcdn.net':80
- 'sh#####d.ff.avast.com':443
TCP
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'sh#####d.ff.avast.com':443
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\icarus-info.xml /install /sssid:1764
- '%WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\avast-du\icarus.exe' /sssid:1764 /er_master:master_ep_dea7f5e5-0183-4619-9429-65b2d3bbbc3a /er_ui:ui_ep_139cc5c6-cfee-4341-9ee2-5cd53c683c9f /er_slave:avast-du_slave_ep_296bb2be-8160-4073-ba26-39de423be49b /slave:a...
- '%WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\common\icarus_ui.exe' /sssid:1764 /er_master:master_ep_dea7f5e5-0183-4619-9429-65b2d3bbbc3a /er_ui:ui_ep_139cc5c6-cfee-4341-9ee2-5cd53c683c9f
- '%WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\avast-du\icarus.exe' /sssid:1764 /er_master:master_ep_dea7f5e5-0183-4619-9429-65b2d3bbbc3a /er_ui:ui_ep_139cc5c6-cfee-4341-9ee2-5cd53c683c9f /er_slave:avast-du_slave_ep_296bb2be-8160-4073-ba26-39de423be49b /slave:a...' (with hidden window)
- '%WINDIR%\temp\asw-f2f27ae2-73bf-4e23-8df9-750cabb5c2da\common\icarus_ui.exe' /sssid:1764 /er_master:master_ep_dea7f5e5-0183-4619-9429-65b2d3bbbc3a /er_ui:ui_ep_139cc5c6-cfee-4341-9ee2-5cd53c683c9f' (with hidden window)
