Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.66491940-cfef-4310-a834-249a05326e29
- %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.932b8768-6deb-479d-8980-11b4ba885a8f
- %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
- %ALLUSERSPROFILE%\avast software\icarus\logs\report.log
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\avast-tu\icarus.exe
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\avast-tu\icarus_product.dll
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\avast-tu\icarus_ui.exe
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\common\icarus_ui.exe
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\avast-tu\icarus_rvrt.exe
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\avast-tu\bug_report.exe
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\avast-tu\product-def.xml
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\avast-tu\setupui.cont
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\avast-tu\product-info.xml
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\avast-tu\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\ecoo.edat
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\icarus-info.xml
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\common\setupui.cont
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\common\43dfee51-2fe4-4bd5-8c5e-f9456fbf375d
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\common\product-def.xml
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\common\6e480b06-886d-4c99-a1bd-1e927ac59161
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\common\product-info.xml
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\common\474190f8-e5b2-48f3-9223-4e48dc68e7bc
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\common\icarus.exe
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\common\520c9f1e-7b5b-4c73-bab0-754bf12abfdb
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\common\icarus_product.dll
- %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.a9dfd8ba-919d-44dc-b372-23db0b7e1a86
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\avast-tu\dump_process.exe
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\common\553657d0-bb36-43bf-83fc-c9811b9b945a
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\common\e1935264-e287-4e3d-b3b8-96c313d01ef1
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\common\dump_process.exe
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\common\f9d98183-cda6-45c1-89e1-44b2bb083f94
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\common\bug_report.exe
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\common\b2f9dbbe-d62d-41f5-aa52-79ecd6a853a5
- %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
- %WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\common\237ccba7-7d45-4b7a-bacc-b7d3f0ab86f0
- %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log
Moves the following files
- from %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.66491940-cfef-4310-a834-249a05326e29 to %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
- from %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.932b8768-6deb-479d-8980-11b4ba885a8f to %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
- from %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.a9dfd8ba-919d-44dc-b372-23db0b7e1a86 to %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log
Network activity
Connects to
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'ho####.avcdn.net':80
- 'sh#####d.ff.avast.com':443
TCP
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'sh#####d.ff.avast.com':443
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\icarus-info.xml /install
- '%WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\avast-tu\icarus.exe' /er_master:master_ep_43aeb5d5-a700-4f6f-9bfa-ecf6db24ad76 /er_ui:ui_ep_591314ed-1a99-42d5-bda9-836427c2d12f /er_slave:avast-tu_slave_ep_ffbf7cce-2412-4594-8bb4-14e53dfe72ac /slave:avast-tu
- '%WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\common\icarus_ui.exe' /er_master:master_ep_43aeb5d5-a700-4f6f-9bfa-ecf6db24ad76 /er_ui:ui_ep_591314ed-1a99-42d5-bda9-836427c2d12f
- '%WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\avast-tu\icarus.exe' /er_master:master_ep_43aeb5d5-a700-4f6f-9bfa-ecf6db24ad76 /er_ui:ui_ep_591314ed-1a99-42d5-bda9-836427c2d12f /er_slave:avast-tu_slave_ep_ffbf7cce-2412-4594-8bb4-14e53dfe72ac /slave:avast-tu' (with hidden window)
- '%WINDIR%\temp\asw-ddc95f72-9f49-426a-8bbd-bfa5cabb00c9\common\icarus_ui.exe' /er_master:master_ep_43aeb5d5-a700-4f6f-9bfa-ecf6db24ad76 /er_ui:ui_ep_591314ed-1a99-42d5-bda9-836427c2d12f' (with hidden window)
