Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\privax\icarus\logs\sfx.log.tmp.0e6b8a07-4199-4b75-84d5-ecb08753f32e
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\icarus-info.xml
- %ALLUSERSPROFILE%\privax\icarus\logs\icarus.log.tmp.3696dce6-69d3-4d4d-b5e5-c48325d50323
- %ALLUSERSPROFILE%\privax\icarus\logs\icarus.log
- %ALLUSERSPROFILE%\privax\icarus\logs\report.log
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\privax-vpn\icarus.exe
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\privax-vpn\icarus_ui.exe
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\privax-vpn\icarus_rvrt.exe
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\privax-vpn\icarus_product.dll
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\privax-vpn\dump_process.exe
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\privax-vpn\bug_report.exe
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\privax-vpn\product-def.xml
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\privax-vpn\setupui.cont
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\privax-vpn\product-info.xml
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\privax-vpn\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\common\setupui.cont
- %ALLUSERSPROFILE%\privax\icarus\logs\sui.log.tmp.1346c587-cacc-4fae-be0e-3419286bc95b
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\common\d44c67ba-9018-4765-8041-82b6f6cb1d7b
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\common\ab6e9391-4efa-47ea-91d1-b62f717abdc1
- %ALLUSERSPROFILE%\privax\icarus\logs\sfx.log
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\common\c2372b5b-b2b3-4a0a-9ebc-1576263ed304
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\common\product-info.xml
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\common\f19b22ab-4859-4d7f-ae61-15a6238ee489
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\common\icarus.exe
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\common\f54374f0-939a-4d24-9b04-0f5796bbc070
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\common\icarus_ui.exe
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\common\e7ebe329-2784-4901-bed8-e2b1165aaa8a
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\common\f15c603a-af80-4909-b45c-067255490520
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\common\icarus_product.dll
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\common\b88aa078-d4ae-4fb5-b40c-7afb7bdba821
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\common\dump_process.exe
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\common\6b9aca65-7cec-4075-9f81-de1f6c24bef2
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\common\bug_report.exe
- %WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\common\product-def.xml
- %ALLUSERSPROFILE%\privax\icarus\logs\sui.log
Moves the following files
- from %ALLUSERSPROFILE%\privax\icarus\logs\sfx.log.tmp.0e6b8a07-4199-4b75-84d5-ecb08753f32e to %ALLUSERSPROFILE%\privax\icarus\logs\sfx.log
- from %ALLUSERSPROFILE%\privax\icarus\logs\icarus.log.tmp.3696dce6-69d3-4d4d-b5e5-c48325d50323 to %ALLUSERSPROFILE%\privax\icarus\logs\icarus.log
- from %ALLUSERSPROFILE%\privax\icarus\logs\sui.log.tmp.1346c587-cacc-4fae-be0e-3419286bc95b to %ALLUSERSPROFILE%\privax\icarus\logs\sui.log
Network activity
TCP
HTTP GET requests
- http://ho####.avcdn.net/dll/privax-vpn/x86/icarus_mod.dll.lzma
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\icarus-info.xml /install /sssid:2192
- '%WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\privax-vpn\icarus.exe' /sssid:2192 /er_master:master_ep_4186bb9c-bcf7-4f1a-928d-ee38edee1c28 /er_ui:ui_ep_c32d36dd-ff60-4d36-969b-b976cf88fd50 /er_slave:privax-vpn_slave_ep_7a86d8f9-4a80-4992-8b7c-cb5fdcf9d924 /slave...
- '%WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\common\icarus_ui.exe' /sssid:2192 /er_master:master_ep_4186bb9c-bcf7-4f1a-928d-ee38edee1c28 /er_ui:ui_ep_c32d36dd-ff60-4d36-969b-b976cf88fd50
- '%WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\privax-vpn\icarus.exe' /sssid:2192 /er_master:master_ep_4186bb9c-bcf7-4f1a-928d-ee38edee1c28 /er_ui:ui_ep_c32d36dd-ff60-4d36-969b-b976cf88fd50 /er_slave:privax-vpn_slave_ep_7a86d8f9-4a80-4992-8b7c-cb5fdcf9d924 /slave...' (with hidden window)
- '%WINDIR%\temp\asw-34cfba8a-f7b0-4a69-9a7d-a11bba3f4e90\common\icarus_ui.exe' /sssid:2192 /er_master:master_ep_4186bb9c-bcf7-4f1a-928d-ee38edee1c28 /er_ui:ui_ep_c32d36dd-ff60-4d36-969b-b976cf88fd50' (with hidden window)
