Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.d3464e89-b7a2-4c6b-a383-3e6a08ecd579
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\ecoo.edat
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\icarus-info.xml
- %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.cfbee0b8-730c-48cd-9142-6731a42a21fd
- %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
- %ALLUSERSPROFILE%\avast software\icarus\logs\report.log
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\avast-du\icarus.exe
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\avast-du\icarus_product.dll
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\avast-du\icarus_rvrt.exe
- %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.4f0887c1-39cb-495e-aafa-d0c9614139ca
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\avast-du\dump_process.exe
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\avast-du\bug_report.exe
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\avast-du\product-def.xml
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\avast-du\setupui.cont
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\avast-du\product-info.xml
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\avast-du\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\trid.edat
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\avast-du\icarus_ui.exe
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\common\setupui.cont
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\common\c7789d44-7a01-4fa7-b078-6de9cc324371
- %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\common\613d74d7-756a-492f-9059-c3a654b35fb3
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\common\product-info.xml
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\common\8727f66b-fed4-4ceb-ba9b-dd03519c4973
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\common\icarus.exe
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\common\5faf3d8f-c6cb-40ba-bcf1-dfd3753cebb9
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\common\icarus_product.dll
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\common\icarus_ui.exe
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\common\product-def.xml
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\common\b4315986-4855-4b0c-b151-9cadf4f8175a
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\common\203d77c9-8e26-4c29-a2d1-579c83600297
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\common\dump_process.exe
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\common\c0e16fac-bcf5-4ad9-ba30-fd1c385d3ad8
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\common\bug_report.exe
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\common\b028ea6e-9902-47d4-99bf-0b5b77c826f8
- %WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\common\e6b8dde7-4c21-4a89-8c43-bf1fdea3c4e4
- %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log
Moves the following files
- from %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.d3464e89-b7a2-4c6b-a383-3e6a08ecd579 to %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
- from %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.cfbee0b8-730c-48cd-9142-6731a42a21fd to %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
- from %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.4f0887c1-39cb-495e-aafa-d0c9614139ca to %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log
Network activity
Connects to
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'ho####.avcdn.net':80
- 'sh#####d.ff.avast.com':443
TCP
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'sh#####d.ff.avast.com':443
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\icarus-info.xml /install /sssid:2916
- '%WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\avast-du\icarus.exe' /sssid:2916 /er_master:master_ep_1d34dd35-fc4f-4ab0-8998-c41579e5bf27 /er_ui:ui_ep_ba6d7480-b710-4519-87db-7c4798c5c14e /er_slave:avast-du_slave_ep_834b28c6-01b0-4d16-92bd-98366ba7133e /slave:a...
- '%WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\common\icarus_ui.exe' /sssid:2916 /er_master:master_ep_1d34dd35-fc4f-4ab0-8998-c41579e5bf27 /er_ui:ui_ep_ba6d7480-b710-4519-87db-7c4798c5c14e
- '%WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\avast-du\icarus.exe' /sssid:2916 /er_master:master_ep_1d34dd35-fc4f-4ab0-8998-c41579e5bf27 /er_ui:ui_ep_ba6d7480-b710-4519-87db-7c4798c5c14e /er_slave:avast-du_slave_ep_834b28c6-01b0-4d16-92bd-98366ba7133e /slave:a...' (with hidden window)
- '%WINDIR%\temp\asw-8fe2402c-5276-4728-999a-1b735ad05033\common\icarus_ui.exe' /sssid:2916 /er_master:master_ep_1d34dd35-fc4f-4ab0-8998-c41579e5bf27 /er_ui:ui_ep_ba6d7480-b710-4519-87db-7c4798c5c14e' (with hidden window)
