Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.7a3043d9-00fc-4e7f-b710-b5e642eb682e
- %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.daa7cdae-6be9-4569-89c2-8c0053006fc7
- %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
- %ALLUSERSPROFILE%\avast software\icarus\logs\report.log
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\avast-vpn\icarus.exe
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\avast-vpn\icarus_ui.exe
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\avast-vpn\icarus_rvrt.exe
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\avast-vpn\icarus_product.dll
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\avast-vpn\bug_report.exe
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\avast-vpn\product-def.xml
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\avast-vpn\setupui.cont
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\avast-vpn\product-info.xml
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\avast-vpn\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\ecoo.edat
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\icarus-info.xml
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\common\setupui.cont
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\common\24d8b59d-ab4e-4107-a3b8-fe9f6d41234b
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\common\product-def.xml
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\common\4b7b648d-0aed-4cde-8b5d-0a11b87f348d
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\common\product-info.xml
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\common\b9b7eaee-bb3d-40e7-9167-b5fa5d25986e
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\common\icarus.exe
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\common\3f1db10a-c3ac-4051-8bb2-c268c42df838
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\common\icarus_ui.exe
- %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.f5658163-915f-4648-b9e7-b954f0fbf6cc
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\avast-vpn\dump_process.exe
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\common\4d10408d-8b1f-4f8a-b268-4a4df7eb1819
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\common\icarus_product.dll
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\common\9641ddda-662e-4136-a281-9942a55beaa6
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\common\dump_process.exe
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\common\a0c850fd-4b5d-4c49-8903-35d5da9d763c
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\common\bug_report.exe
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\common\7aacaaca-0b78-4645-88fe-326c11f11901
- %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
- %WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\common\5cd92749-9157-49f1-b3f1-7e403580a792
- %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log
Moves the following files
- from %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.7a3043d9-00fc-4e7f-b710-b5e642eb682e to %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
- from %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.daa7cdae-6be9-4569-89c2-8c0053006fc7 to %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
- from %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.f5658163-915f-4648-b9e7-b954f0fbf6cc to %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log
Network activity
Connects to
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'ho####.avcdn.net':80
- 'sh#####d.ff.avast.com':443
TCP
Other
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'sh#####d.ff.avast.com':443
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\icarus-info.xml /install /sssid:2884
- '%WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\avast-vpn\icarus.exe' /sssid:2884 /er_master:master_ep_8659e4a0-be3f-498d-b8b1-f8b81658994e /er_ui:ui_ep_336fda1e-22ef-4ff1-ac64-8987b312e02b /er_slave:avast-vpn_slave_ep_e2c4e3a5-201e-4bf4-af96-9ebb55e03a2e /slave:...
- '%WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\common\icarus_ui.exe' /sssid:2884 /er_master:master_ep_8659e4a0-be3f-498d-b8b1-f8b81658994e /er_ui:ui_ep_336fda1e-22ef-4ff1-ac64-8987b312e02b
- '%WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\avast-vpn\icarus.exe' /sssid:2884 /er_master:master_ep_8659e4a0-be3f-498d-b8b1-f8b81658994e /er_ui:ui_ep_336fda1e-22ef-4ff1-ac64-8987b312e02b /er_slave:avast-vpn_slave_ep_e2c4e3a5-201e-4bf4-af96-9ebb55e03a2e /slave:...' (with hidden window)
- '%WINDIR%\temp\asw-c6cdde6d-c9e3-4e1c-af84-b5d1728cf0f2\common\icarus_ui.exe' /sssid:2884 /er_master:master_ep_8659e4a0-be3f-498d-b8b1-f8b81658994e /er_ui:ui_ep_336fda1e-22ef-4ff1-ac64-8987b312e02b' (with hidden window)
