Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\privax\icarus\logs\sfx.log.tmp.1adb8b58-800e-47cd-a3b3-861723dff2b5
- %ALLUSERSPROFILE%\privax\icarus\logs\icarus.log.tmp.eb0d4676-e1d6-468d-960c-d0f77616759d
- %ALLUSERSPROFILE%\privax\icarus\logs\icarus.log
- %ALLUSERSPROFILE%\privax\icarus\logs\report.log
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\privax-vpn\icarus.exe
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\privax-vpn\icarus_ui.exe
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\privax-vpn\icarus_rvrt.exe
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\privax-vpn\icarus_product.dll
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\privax-vpn\bug_report.exe
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\privax-vpn\product-def.xml
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\privax-vpn\setupui.cont
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\privax-vpn\product-info.xml
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\privax-vpn\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\ecoo.edat
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\icarus-info.xml
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\common\setupui.cont
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\common\c0143882-e1a0-4079-b75c-ddfbc9f570c5
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\common\product-def.xml
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\common\88a75994-d90b-4505-ae22-69953e3af7fe
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\common\product-info.xml
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\common\e69cecb8-4065-4a24-9ebc-618cb4895a58
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\common\icarus.exe
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\common\4048f70f-ea56-4d50-b751-c794c0378db3
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\common\icarus_ui.exe
- %ALLUSERSPROFILE%\privax\icarus\logs\sui.log.tmp.2faa4449-efcf-4501-8154-b19a9b527f61
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\privax-vpn\dump_process.exe
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\common\be8a0a30-e627-46da-8f4e-13ebf7deacfa
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\common\icarus_product.dll
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\common\0d810eb3-9835-4933-af90-adc5d1f40c74
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\common\dump_process.exe
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\common\0d841c09-8208-4892-9793-c6aacd3ccf69
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\common\bug_report.exe
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\common\75ec673b-67da-4df9-b459-59f31f0b5b5e
- %ALLUSERSPROFILE%\privax\icarus\logs\sfx.log
- %WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\common\06aa9503-a859-4f90-9a8a-21a4e94ee84f
- %ALLUSERSPROFILE%\privax\icarus\logs\sui.log
Moves the following files
- from %ALLUSERSPROFILE%\privax\icarus\logs\sfx.log.tmp.1adb8b58-800e-47cd-a3b3-861723dff2b5 to %ALLUSERSPROFILE%\privax\icarus\logs\sfx.log
- from %ALLUSERSPROFILE%\privax\icarus\logs\icarus.log.tmp.eb0d4676-e1d6-468d-960c-d0f77616759d to %ALLUSERSPROFILE%\privax\icarus\logs\icarus.log
- from %ALLUSERSPROFILE%\privax\icarus\logs\sui.log.tmp.2faa4449-efcf-4501-8154-b19a9b527f61 to %ALLUSERSPROFILE%\privax\icarus\logs\sui.log
Network activity
Connects to
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'ho####.avcdn.net':80
- 'sh#####d.ff.avast.com':443
TCP
Other
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'sh#####d.ff.avast.com':443
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\icarus-info.xml /install /sssid:2448
- '%WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\privax-vpn\icarus.exe' /sssid:2448 /er_master:master_ep_b7c6b3d7-bee2-4e2c-8c68-1fa0fea893e0 /er_ui:ui_ep_0aeb4b30-b146-4b6e-9ae6-4e0a78cd6734 /er_slave:privax-vpn_slave_ep_6f41f476-85aa-4cc1-b88a-363df93dc8c5 /slave...
- '%WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\common\icarus_ui.exe' /sssid:2448 /er_master:master_ep_b7c6b3d7-bee2-4e2c-8c68-1fa0fea893e0 /er_ui:ui_ep_0aeb4b30-b146-4b6e-9ae6-4e0a78cd6734
- '%WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\privax-vpn\icarus.exe' /sssid:2448 /er_master:master_ep_b7c6b3d7-bee2-4e2c-8c68-1fa0fea893e0 /er_ui:ui_ep_0aeb4b30-b146-4b6e-9ae6-4e0a78cd6734 /er_slave:privax-vpn_slave_ep_6f41f476-85aa-4cc1-b88a-363df93dc8c5 /slave...' (with hidden window)
- '%WINDIR%\temp\asw-6762fadf-5ed2-4d69-977c-530124c7ba0a\common\icarus_ui.exe' /sssid:2448 /er_master:master_ep_b7c6b3d7-bee2-4e2c-8c68-1fa0fea893e0 /er_ui:ui_ep_0aeb4b30-b146-4b6e-9ae6-4e0a78cd6734' (with hidden window)
