Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\privax\icarus\logs\sfx.log.tmp.182b1b38-d1af-4106-a76f-dc54a8270aed
- %ALLUSERSPROFILE%\privax\icarus\logs\icarus.log.tmp.8603f190-71d5-4579-82d6-09410e8afbf7
- %ALLUSERSPROFILE%\privax\icarus\logs\icarus.log
- %ALLUSERSPROFILE%\privax\icarus\logs\report.log
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\privax-vpn\icarus.exe
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\privax-vpn\icarus_ui.exe
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\privax-vpn\icarus_rvrt.exe
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\privax-vpn\icarus_product.dll
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\privax-vpn\bug_report.exe
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\privax-vpn\product-def.xml
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\privax-vpn\setupui.cont
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\privax-vpn\product-info.xml
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\privax-vpn\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\ecoo.edat
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\icarus-info.xml
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\common\setupui.cont
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\common\4581ab12-f4fe-4a22-bcd9-54d438830e1b
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\common\product-def.xml
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\common\57bd1f5a-ad9c-46ec-9729-eb676a0662dd
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\common\product-info.xml
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\common\98152ea8-4496-4aec-a813-57fcbbadb008
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\common\icarus.exe
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\common\8a714cf0-3958-4514-a46f-da10cd79554f
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\common\icarus_ui.exe
- %ALLUSERSPROFILE%\privax\icarus\logs\sui.log.tmp.d83b0ba7-d23e-478c-baab-c9492057bf50
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\privax-vpn\dump_process.exe
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\common\afa06389-32dd-47ae-acf3-b13f27f2ba9a
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\common\icarus_product.dll
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\common\1ba67626-b561-4524-93c4-c731dfe74da8
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\common\dump_process.exe
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\common\4b4e751c-ca08-431d-b6db-c711cab4d1fd
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\common\bug_report.exe
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\common\6d0cc54c-d16a-40a2-a409-5ca8cb178a5e
- %ALLUSERSPROFILE%\privax\icarus\logs\sfx.log
- %WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\common\c14e88ba-2152-4d6e-8e6c-27860dece7fe
- %ALLUSERSPROFILE%\privax\icarus\logs\sui.log
Moves the following files
- from %ALLUSERSPROFILE%\privax\icarus\logs\sfx.log.tmp.182b1b38-d1af-4106-a76f-dc54a8270aed to %ALLUSERSPROFILE%\privax\icarus\logs\sfx.log
- from %ALLUSERSPROFILE%\privax\icarus\logs\icarus.log.tmp.8603f190-71d5-4579-82d6-09410e8afbf7 to %ALLUSERSPROFILE%\privax\icarus\logs\icarus.log
- from %ALLUSERSPROFILE%\privax\icarus\logs\sui.log.tmp.d83b0ba7-d23e-478c-baab-c9492057bf50 to %ALLUSERSPROFILE%\privax\icarus\logs\sui.log
Network activity
Connects to
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'ho####.avcdn.net':80
- 'sh#####d.ff.avast.com':443
TCP
Other
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'sh#####d.ff.avast.com':443
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\icarus-info.xml /install /sssid:1608
- '%WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\privax-vpn\icarus.exe' /sssid:1608 /er_master:master_ep_b9d351a1-ea65-499e-b26d-7d1396cee0e5 /er_ui:ui_ep_59ac7795-7d77-4a12-904d-238f3d5d4d37 /er_slave:privax-vpn_slave_ep_c1e51fb3-92ea-46f2-ba9a-574e5d3142e7 /slave...
- '%WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\common\icarus_ui.exe' /sssid:1608 /er_master:master_ep_b9d351a1-ea65-499e-b26d-7d1396cee0e5 /er_ui:ui_ep_59ac7795-7d77-4a12-904d-238f3d5d4d37
- '%WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\privax-vpn\icarus.exe' /sssid:1608 /er_master:master_ep_b9d351a1-ea65-499e-b26d-7d1396cee0e5 /er_ui:ui_ep_59ac7795-7d77-4a12-904d-238f3d5d4d37 /er_slave:privax-vpn_slave_ep_c1e51fb3-92ea-46f2-ba9a-574e5d3142e7 /slave...' (with hidden window)
- '%WINDIR%\temp\asw-c5b3b33c-9cb7-4728-b192-1752360fe0a9\common\icarus_ui.exe' /sssid:1608 /er_master:master_ep_b9d351a1-ea65-499e-b26d-7d1396cee0e5 /er_ui:ui_ep_59ac7795-7d77-4a12-904d-238f3d5d4d37' (with hidden window)
