Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %PROGRAMDATA%\avg\icarus\logs\sfx.log.tmp.4891bef7-33dd-40ce-8c3b-c1e3746b783c
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\icarus-info.xml
- %PROGRAMDATA%\avg\icarus\logs\icarus.log.tmp.ded9f4e7-8f77-473d-9cab-cb97796fd09c
- %PROGRAMDATA%\avg\icarus\logs\icarus.log
- %PROGRAMDATA%\avg\icarus\logs\report.log
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\avg-tu\icarus.exe
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\avg-tu\icarus_product.dll
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\avg-tu\icarus_ui.exe
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\avg-tu\icarus_rvrt.exe
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\avg-tu\dump_process.exe
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\avg-tu\bug_report.exe
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\avg-tu\product-def.xml
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\avg-tu\setupui.cont
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\avg-tu\product-info.xml
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\avg-tu\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\common\setupui.cont
- %PROGRAMDATA%\avg\icarus\logs\sui.log.tmp.c8964a2d-8d89-48fb-9148-42047c719a39
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\common\00e74201-5281-42a9-a81a-fd297a0132a6
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\common\e89d846c-28fe-4f33-9b33-0953218351b5
- %PROGRAMDATA%\avg\icarus\logs\sfx.log
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\common\e942a609-af3f-41a5-8296-b6f3903d0758
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\common\product-info.xml
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\common\2cd85653-e842-40a9-bc16-2bb065edadf7
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\common\icarus.exe
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\common\bc138eb2-a506-4b94-8b97-8c7ebd5b5804
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\common\icarus_product.dll
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\common\c82bafe7-137f-41e5-98b9-74977de139fb
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\common\icarus_ui.exe
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\common\2a4169e5-b434-4356-a75f-82aebfc85e38
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\common\439a8c45-b14d-400c-b117-9c9691e113b3
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\common\dump_process.exe
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\common\930c01c2-83f0-4d7f-8d0e-6f88f7f5456c
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\common\bug_report.exe
- %WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\common\product-def.xml
- %PROGRAMDATA%\avg\icarus\logs\sui.log
Moves the following files
- from %PROGRAMDATA%\avg\icarus\logs\sfx.log.tmp.4891bef7-33dd-40ce-8c3b-c1e3746b783c to %PROGRAMDATA%\avg\icarus\logs\sfx.log
- from %PROGRAMDATA%\avg\icarus\logs\icarus.log.tmp.ded9f4e7-8f77-473d-9cab-cb97796fd09c to %PROGRAMDATA%\avg\icarus\logs\icarus.log
- from %PROGRAMDATA%\avg\icarus\logs\sui.log.tmp.c8964a2d-8d89-48fb-9148-42047c719a39 to %PROGRAMDATA%\avg\icarus\logs\sui.log
Network activity
TCP
HTTP GET requests
- http://ho####.avcdn.net/dll/avg-tu/x86/icarus_mod.dll.lzma
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\icarus-info.xml /install
- '%WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\avg-tu\icarus.exe' /er_master:master_ep_7afbdae6-34b4-4c9e-8eae-851850e0d9da /er_ui:ui_ep_707e98fd-b2d7-49c6-b035-9917d238ecf5 /er_slave:avg-tu_slave_ep_5cc4bd78-32e4-4960-b929-c31137965296 /slave:avg-tu
- '%WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\common\icarus_ui.exe' /er_master:master_ep_7afbdae6-34b4-4c9e-8eae-851850e0d9da /er_ui:ui_ep_707e98fd-b2d7-49c6-b035-9917d238ecf5
- '%WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\avg-tu\icarus.exe' /er_master:master_ep_7afbdae6-34b4-4c9e-8eae-851850e0d9da /er_ui:ui_ep_707e98fd-b2d7-49c6-b035-9917d238ecf5 /er_slave:avg-tu_slave_ep_5cc4bd78-32e4-4960-b929-c31137965296 /slave:avg-tu' (with hidden window)
- '%WINDIR%\temp\asw-5a03c7d2-07df-447d-a8bd-ec6f5c3ed1c7\common\icarus_ui.exe' /er_master:master_ep_7afbdae6-34b4-4c9e-8eae-851850e0d9da /er_ui:ui_ep_707e98fd-b2d7-49c6-b035-9917d238ecf5' (with hidden window)
