Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log.tmp.fa365745-65bc-46e2-8fd7-1d6f2d055bb2
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\ecoo.edat
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\icarus-info.xml
- %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log.tmp.0c52a500-4a66-47f1-933a-9aa3fa78fb35
- %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log
- %ALLUSERSPROFILE%\avg\icarus\logs\report.log
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\avg-tu\icarus.exe
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\avg-tu\icarus_product.dll
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\avg-tu\icarus_rvrt.exe
- %ALLUSERSPROFILE%\avg\icarus\logs\sui.log.tmp.1a324e75-0090-4b05-8c37-e5b3ce77477a
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\avg-tu\dump_process.exe
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\avg-tu\bug_report.exe
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\avg-tu\product-def.xml
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\avg-tu\setupui.cont
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\avg-tu\product-info.xml
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\avg-tu\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\trid.edat
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\avg-tu\icarus_ui.exe
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\common\setupui.cont
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\common\a9945fd5-a1a0-4d07-be06-55787d792558
- %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\common\5666f980-bd0b-44ca-a6d8-fa6413ef368c
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\common\product-info.xml
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\common\78a9a639-7f0b-414f-916b-64af0760cd22
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\common\icarus.exe
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\common\3983b96f-2a99-4803-8f9f-e59eb73817e8
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\common\icarus_product.dll
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\common\icarus_ui.exe
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\common\product-def.xml
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\common\3a322945-ed1b-4905-bfc6-14d418091716
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\common\15f15aab-8e41-40e9-9bc3-97783d0a55d2
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\common\dump_process.exe
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\common\f5b7a88f-5a65-4bf8-9908-8df51bf29101
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\common\bug_report.exe
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\common\1fe94317-faa9-4ea5-9758-abb505e044ec
- %WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\common\9c701063-ce25-49b9-9ef7-9bf22073e9a0
- %ALLUSERSPROFILE%\avg\icarus\logs\sui.log
Moves the following files
- from %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log.tmp.fa365745-65bc-46e2-8fd7-1d6f2d055bb2 to %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log
- from %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log.tmp.0c52a500-4a66-47f1-933a-9aa3fa78fb35 to %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log
- from %ALLUSERSPROFILE%\avg\icarus\logs\sui.log.tmp.1a324e75-0090-4b05-8c37-e5b3ce77477a to %ALLUSERSPROFILE%\avg\icarus\logs\sui.log
Network activity
Connects to
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'ho####.avcdn.net':80
- 'sh#####d.ff.avast.com':443
TCP
Other
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'sh#####d.ff.avast.com':443
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\icarus-info.xml /install /sssid:780
- '%WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\avg-tu\icarus.exe' /sssid:780 /er_master:master_ep_07fada3b-f69c-4a24-b305-a8e7eccae8eb /er_ui:ui_ep_22f9a492-dfe2-453a-bfaf-6ebbbc77bb44 /er_slave:avg-tu_slave_ep_dee9c24a-d56d-41b6-8207-d6226baac25d /slave:avg-...
- '%WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\common\icarus_ui.exe' /sssid:780 /er_master:master_ep_07fada3b-f69c-4a24-b305-a8e7eccae8eb /er_ui:ui_ep_22f9a492-dfe2-453a-bfaf-6ebbbc77bb44
- '%WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\avg-tu\icarus.exe' /sssid:780 /er_master:master_ep_07fada3b-f69c-4a24-b305-a8e7eccae8eb /er_ui:ui_ep_22f9a492-dfe2-453a-bfaf-6ebbbc77bb44 /er_slave:avg-tu_slave_ep_dee9c24a-d56d-41b6-8207-d6226baac25d /slave:avg-...' (with hidden window)
- '%WINDIR%\temp\asw-526892e4-3905-41bc-971c-d98f6a8ad489\common\icarus_ui.exe' /sssid:780 /er_master:master_ep_07fada3b-f69c-4a24-b305-a8e7eccae8eb /er_ui:ui_ep_22f9a492-dfe2-453a-bfaf-6ebbbc77bb44' (with hidden window)
