Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\privax\icarus\logs\sfx.log.tmp.77a85504-03eb-4b3d-b54b-814182e45e56
- %ALLUSERSPROFILE%\privax\icarus\logs\icarus.log.tmp.7bb7c3fe-a07e-4aa0-8439-aa7b5d9e1bf6
- %ALLUSERSPROFILE%\privax\icarus\logs\icarus.log
- %ALLUSERSPROFILE%\privax\icarus\logs\report.log
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\privax-vpn\icarus.exe
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\privax-vpn\icarus_ui.exe
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\privax-vpn\icarus_rvrt.exe
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\privax-vpn\icarus_product.dll
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\privax-vpn\bug_report.exe
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\privax-vpn\product-def.xml
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\privax-vpn\setupui.cont
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\privax-vpn\product-info.xml
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\privax-vpn\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\ecoo.edat
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\icarus-info.xml
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\common\setupui.cont
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\common\c713f4e2-2591-4281-9c81-2e2d75fc9bb2
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\common\product-def.xml
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\common\171f8c32-0e89-4628-9c32-0a271a96d85c
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\common\product-info.xml
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\common\787915e1-aa84-4846-b2d1-074500a075d6
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\common\icarus.exe
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\common\300783c5-8b90-4917-85d4-9c5dc1db9b27
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\common\icarus_ui.exe
- %ALLUSERSPROFILE%\privax\icarus\logs\sui.log.tmp.d0f7f232-7d8e-42ee-9c17-2612cab47a95
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\privax-vpn\dump_process.exe
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\common\e91e4577-5e3e-4ee5-8bdb-8dc6d0fa8d4c
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\common\icarus_product.dll
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\common\e98093af-4746-4325-98e9-b0d58fe7554a
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\common\dump_process.exe
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\common\de7060b2-de05-4bad-809a-a3f1b82d90db
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\common\bug_report.exe
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\common\55e2d94c-7fb8-40ff-9904-5dee62f350cf
- %ALLUSERSPROFILE%\privax\icarus\logs\sfx.log
- %WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\common\61df7857-671c-403f-8080-d0610d05b363
- %ALLUSERSPROFILE%\privax\icarus\logs\sui.log
Moves the following files
- from %ALLUSERSPROFILE%\privax\icarus\logs\sfx.log.tmp.77a85504-03eb-4b3d-b54b-814182e45e56 to %ALLUSERSPROFILE%\privax\icarus\logs\sfx.log
- from %ALLUSERSPROFILE%\privax\icarus\logs\icarus.log.tmp.7bb7c3fe-a07e-4aa0-8439-aa7b5d9e1bf6 to %ALLUSERSPROFILE%\privax\icarus\logs\icarus.log
- from %ALLUSERSPROFILE%\privax\icarus\logs\sui.log.tmp.d0f7f232-7d8e-42ee-9c17-2612cab47a95 to %ALLUSERSPROFILE%\privax\icarus\logs\sui.log
Network activity
Connects to
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'ho####.avcdn.net':80
- 'sh#####d.ff.avast.com':443
TCP
Other
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'sh#####d.ff.avast.com':443
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\icarus-info.xml /install /sssid:2764
- '%WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\privax-vpn\icarus.exe' /sssid:2764 /er_master:master_ep_c75bb380-4f0f-40b0-aa77-f07fb7f8f829 /er_ui:ui_ep_dbeb1318-a0f4-4896-aefe-9d9f5234de3b /er_slave:privax-vpn_slave_ep_dbecc980-085b-45d2-9c64-59d4ecfb0218 /slave...
- '%WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\common\icarus_ui.exe' /sssid:2764 /er_master:master_ep_c75bb380-4f0f-40b0-aa77-f07fb7f8f829 /er_ui:ui_ep_dbeb1318-a0f4-4896-aefe-9d9f5234de3b
- '%WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\privax-vpn\icarus.exe' /sssid:2764 /er_master:master_ep_c75bb380-4f0f-40b0-aa77-f07fb7f8f829 /er_ui:ui_ep_dbeb1318-a0f4-4896-aefe-9d9f5234de3b /er_slave:privax-vpn_slave_ep_dbecc980-085b-45d2-9c64-59d4ecfb0218 /slave...' (with hidden window)
- '%WINDIR%\temp\asw-1197a37b-66d9-4bc1-97cf-4c697ec7599d\common\icarus_ui.exe' /sssid:2764 /er_master:master_ep_c75bb380-4f0f-40b0-aa77-f07fb7f8f829 /er_ui:ui_ep_dbeb1318-a0f4-4896-aefe-9d9f5234de3b' (with hidden window)
