Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.8ebc502c-8bf5-4069-abd2-6651138a2564
- %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.20f4d90c-8c7b-4062-bd48-2e5df5d32743
- %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
- %ALLUSERSPROFILE%\avast software\icarus\logs\report.log
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\avast-vpn\icarus.exe
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\avast-vpn\icarus_ui.exe
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\avast-vpn\icarus_rvrt.exe
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\avast-vpn\icarus_product.dll
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\avast-vpn\bug_report.exe
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\avast-vpn\product-def.xml
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\avast-vpn\setupui.cont
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\avast-vpn\product-info.xml
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\avast-vpn\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\ecoo.edat
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\icarus-info.xml
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\common\setupui.cont
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\common\2d75fc1c-5b10-47ca-9b4d-bd4a0a5bc6aa
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\common\product-def.xml
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\common\111a5c35-a3b5-496e-bb2d-45b5fa07da37
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\common\product-info.xml
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\common\28faa054-f4cb-45dc-af87-0e527d1d0216
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\common\icarus.exe
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\common\2e93e35d-b94a-4220-bbd0-eee2ad070add
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\common\icarus_ui.exe
- %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.cd5705f7-8e03-42bc-afc3-92b4631bf9dc
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\avast-vpn\dump_process.exe
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\common\416c1c14-e66c-45de-960f-62fe50009450
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\common\icarus_product.dll
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\common\723be097-f9fb-4e99-9aa2-ee2f0427fdcb
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\common\dump_process.exe
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\common\594ad5b7-1908-4e8f-8d24-ee3a444714ef
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\common\bug_report.exe
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\common\202ebbf2-f696-4418-8170-7a2f02756df4
- %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
- %WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\common\558ae057-9ca8-484a-8bdd-fffc106ebd51
- %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log
Moves the following files
- from %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.8ebc502c-8bf5-4069-abd2-6651138a2564 to %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
- from %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.20f4d90c-8c7b-4062-bd48-2e5df5d32743 to %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
- from %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.cd5705f7-8e03-42bc-afc3-92b4631bf9dc to %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log
Network activity
Connects to
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'ho####.avcdn.net':80
- 'sh#####d.ff.avast.com':443
TCP
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'sh#####d.ff.avast.com':443
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\icarus-info.xml /install /sssid:2412
- '%WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\avast-vpn\icarus.exe' /sssid:2412 /er_master:master_ep_22008740-c1a7-4d6e-917b-a697de06fa27 /er_ui:ui_ep_20b8a9e9-d18b-4424-801f-bb7b3e614c93 /er_slave:avast-vpn_slave_ep_74b66216-fea0-4f2a-aecf-5f1e0e55a1e9 /slave:...
- '%WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\common\icarus_ui.exe' /sssid:2412 /er_master:master_ep_22008740-c1a7-4d6e-917b-a697de06fa27 /er_ui:ui_ep_20b8a9e9-d18b-4424-801f-bb7b3e614c93
- '%WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\avast-vpn\icarus.exe' /sssid:2412 /er_master:master_ep_22008740-c1a7-4d6e-917b-a697de06fa27 /er_ui:ui_ep_20b8a9e9-d18b-4424-801f-bb7b3e614c93 /er_slave:avast-vpn_slave_ep_74b66216-fea0-4f2a-aecf-5f1e0e55a1e9 /slave:...' (with hidden window)
- '%WINDIR%\temp\asw-e8169ad4-e0e9-4413-b373-c86b73b367dd\common\icarus_ui.exe' /sssid:2412 /er_master:master_ep_22008740-c1a7-4d6e-917b-a697de06fa27 /er_ui:ui_ep_20b8a9e9-d18b-4424-801f-bb7b3e614c93' (with hidden window)
