Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.fc8eaf01-b060-4b02-b466-dc876d7705d3
- %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.327d7e6b-9fec-4c0f-b0e4-6fc91db404e5
- %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
- %ALLUSERSPROFILE%\avast software\icarus\logs\report.log
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\avast-vpn\icarus.exe
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\avast-vpn\icarus_ui.exe
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\avast-vpn\icarus_rvrt.exe
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\avast-vpn\icarus_product.dll
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\avast-vpn\bug_report.exe
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\avast-vpn\product-def.xml
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\avast-vpn\setupui.cont
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\avast-vpn\product-info.xml
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\avast-vpn\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\ecoo.edat
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\icarus-info.xml
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\common\setupui.cont
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\common\87f882e4-0264-4fa9-8088-b4509dd9bbb3
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\common\product-def.xml
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\common\73192210-1e1e-48e2-9632-da6e21afb59b
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\common\product-info.xml
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\common\8a5cb558-de56-4457-a7f7-448a8b258018
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\common\icarus.exe
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\common\b6be651f-7b76-473a-9b2b-23a636c1f1c3
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\common\icarus_ui.exe
- %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.2865de6c-f564-4bc2-a4b5-e690727001ea
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\avast-vpn\dump_process.exe
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\common\0b6f17dd-f510-4f00-96b8-51455cb09114
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\common\icarus_product.dll
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\common\9b6bc5ce-cbaf-436a-a3d8-c2df5a6ac4f7
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\common\dump_process.exe
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\common\eca4b6a9-fe28-4e1f-838c-0cb09fbcf964
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\common\bug_report.exe
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\common\f5adea32-47ba-4fc1-845c-fe4baf1f1d04
- %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
- %WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\common\879ad610-0a96-483c-a2ea-7bea11ec1610
- %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log
Moves the following files
- from %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.fc8eaf01-b060-4b02-b466-dc876d7705d3 to %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
- from %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.327d7e6b-9fec-4c0f-b0e4-6fc91db404e5 to %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
- from %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.2865de6c-f564-4bc2-a4b5-e690727001ea to %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log
Network activity
Connects to
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'ho####.avcdn.net':80
- 'sh#####d.ff.avast.com':443
TCP
Other
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'sh#####d.ff.avast.com':443
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\icarus-info.xml /install /sssid:676
- '%WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\avast-vpn\icarus.exe' /sssid:676 /er_master:master_ep_54995aff-2f30-4d74-8df1-26d852d0c02c /er_ui:ui_ep_971e0e92-0134-4e08-8194-ffe4d07c59bd /er_slave:avast-vpn_slave_ep_339a4b92-90cb-442f-8bcb-45a7a882a6b4 /slave:a...
- '%WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\common\icarus_ui.exe' /sssid:676 /er_master:master_ep_54995aff-2f30-4d74-8df1-26d852d0c02c /er_ui:ui_ep_971e0e92-0134-4e08-8194-ffe4d07c59bd
- '%WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\avast-vpn\icarus.exe' /sssid:676 /er_master:master_ep_54995aff-2f30-4d74-8df1-26d852d0c02c /er_ui:ui_ep_971e0e92-0134-4e08-8194-ffe4d07c59bd /er_slave:avast-vpn_slave_ep_339a4b92-90cb-442f-8bcb-45a7a882a6b4 /slave:a...' (with hidden window)
- '%WINDIR%\temp\asw-cff04029-e8c4-4e8a-9881-350efca93a5a\common\icarus_ui.exe' /sssid:676 /er_master:master_ep_54995aff-2f30-4d74-8df1-26d852d0c02c /er_ui:ui_ep_971e0e92-0134-4e08-8194-ffe4d07c59bd' (with hidden window)
