Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %PROGRAMDATA%\avast software\icarus\logs\sfx.log.tmp.00e758a7-c728-4fbe-8045-b57771e79198
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\icarus-info.xml
- %PROGRAMDATA%\avast software\icarus\logs\icarus.log.tmp.8662c4dd-46d5-4afe-b73e-53d3682424ba
- %PROGRAMDATA%\avast software\icarus\logs\icarus.log
- %PROGRAMDATA%\avast software\icarus\logs\report.log
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\avast-tu\icarus.exe
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\avast-tu\icarus_product.dll
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\avast-tu\icarus_ui.exe
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\avast-tu\icarus_rvrt.exe
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\avast-tu\dump_process.exe
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\avast-tu\bug_report.exe
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\avast-tu\product-def.xml
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\avast-tu\setupui.cont
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\avast-tu\product-info.xml
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\avast-tu\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\common\setupui.cont
- %PROGRAMDATA%\avast software\icarus\logs\sui.log.tmp.bace6904-d942-4cc5-8316-450e776328bd
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\common\a4c2fea4-d1df-4631-9587-15eebd734ea1
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\common\145d598b-86af-49a9-bbda-dc886e249dff
- %PROGRAMDATA%\avast software\icarus\logs\sfx.log
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\common\15a12725-8a99-4878-9f12-b89100c37276
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\common\product-info.xml
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\common\d52fc9a7-9a3b-4251-88a0-b46283d0f42d
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\common\icarus.exe
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\common\06535a7c-0727-4d86-a103-3ab47a59939a
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\common\icarus_product.dll
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\common\15d0808a-8ea1-4e61-b388-ee512f90cef2
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\common\icarus_ui.exe
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\common\bc443087-3b72-4c28-acab-c5f4a5bab248
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\common\d02823b5-8106-4fc9-a701-ed820ba67e36
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\common\dump_process.exe
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\common\a3e1a4ae-f989-47f6-b8fc-d104201c86d0
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\common\bug_report.exe
- %WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\common\product-def.xml
- %PROGRAMDATA%\avast software\icarus\logs\sui.log
Moves the following files
- from %PROGRAMDATA%\avast software\icarus\logs\sfx.log.tmp.00e758a7-c728-4fbe-8045-b57771e79198 to %PROGRAMDATA%\avast software\icarus\logs\sfx.log
- from %PROGRAMDATA%\avast software\icarus\logs\icarus.log.tmp.8662c4dd-46d5-4afe-b73e-53d3682424ba to %PROGRAMDATA%\avast software\icarus\logs\icarus.log
- from %PROGRAMDATA%\avast software\icarus\logs\sui.log.tmp.bace6904-d942-4cc5-8316-450e776328bd to %PROGRAMDATA%\avast software\icarus\logs\sui.log
Network activity
TCP
HTTP GET requests
- http://ho####.avcdn.net/dll/avast-tu/x86/icarus_mod.dll.lzma
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\icarus-info.xml /install
- '%WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\avast-tu\icarus.exe' /er_master:master_ep_8ae17632-02ba-4956-b6f0-05b198e04ecd /er_ui:ui_ep_bfcde26b-cc63-4791-b31a-48b646bea348 /er_slave:avast-tu_slave_ep_1e65d597-494d-4af0-b577-2bc6aea51343 /slave:avast-tu
- '%WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\common\icarus_ui.exe' /er_master:master_ep_8ae17632-02ba-4956-b6f0-05b198e04ecd /er_ui:ui_ep_bfcde26b-cc63-4791-b31a-48b646bea348
- '%WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\avast-tu\icarus.exe' /er_master:master_ep_8ae17632-02ba-4956-b6f0-05b198e04ecd /er_ui:ui_ep_bfcde26b-cc63-4791-b31a-48b646bea348 /er_slave:avast-tu_slave_ep_1e65d597-494d-4af0-b577-2bc6aea51343 /slave:avast-tu' (with hidden window)
- '%WINDIR%\temp\asw-628ef237-40e4-4760-a6dc-b8b9eb6c04a2\common\icarus_ui.exe' /er_master:master_ep_8ae17632-02ba-4956-b6f0-05b198e04ecd /er_ui:ui_ep_bfcde26b-cc63-4791-b31a-48b646bea348' (with hidden window)
