Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log.tmp.47e917e7-0340-46b8-8c8c-8dbdcf192229
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\ecoo.edat
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\icarus-info.xml
- %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log.tmp.19e82e2d-2f51-4a65-a915-f4d026cec0ed
- %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log
- %ALLUSERSPROFILE%\avg\icarus\logs\report.log
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\icarus.exe
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\icarus_product.dll
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\icarus_rvrt.exe
- %ALLUSERSPROFILE%\avg\icarus\logs\sui.log.tmp.1fc48900-d078-4410-8e6b-85a3a4589fd4
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\dump_process.exe
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\bug_report.exe
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\product-def.xml
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\setupui.cont
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\product-info.xml
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\trid.edat
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\icarus_ui.exe
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\setupui.cont
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\ffd41767-1ea8-4aac-a9e2-be0a13bb128c
- %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\17ed61be-1fdb-4e17-b8e0-25ccfcd1f79d
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\product-info.xml
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\143c8b4c-47c5-451a-8837-e6abc183eaf5
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\icarus.exe
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\328f893c-b661-4ecf-902d-63b7d471628b
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\icarus_product.dll
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\icarus_ui.exe
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\product-def.xml
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\54d62578-1526-4c87-bc8d-6040e0d17472
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\4ebe2232-0d82-49b2-8084-dc0f73a9b23d
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\dump_process.exe
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\4208f07d-1c00-45d4-b0ad-539f212c03f0
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\bug_report.exe
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\d0e1165b-a117-4334-8428-718d4ff86439
- %WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\ebe15063-d2cb-41c6-afea-adab45f90aa6
- %ALLUSERSPROFILE%\avg\icarus\logs\sui.log
Moves the following files
- from %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log.tmp.47e917e7-0340-46b8-8c8c-8dbdcf192229 to %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log
- from %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log.tmp.19e82e2d-2f51-4a65-a915-f4d026cec0ed to %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log
- from %ALLUSERSPROFILE%\avg\icarus\logs\sui.log.tmp.1fc48900-d078-4410-8e6b-85a3a4589fd4 to %ALLUSERSPROFILE%\avg\icarus\logs\sui.log
Network activity
Connects to
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'ho####.avcdn.net':80
- 'sh#####d.ff.avast.com':443
TCP
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'sh#####d.ff.avast.com':443
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\icarus-info.xml /install /sssid:2644
- '%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\icarus.exe' /sssid:2644 /er_master:master_ep_9c1b1679-ecd9-4856-ac30-7b5904cad551 /er_ui:ui_ep_b389a2d6-9ef2-4d96-95a9-672f581bb1bf /er_slave:avg-tu_slave_ep_a2fdf823-9132-4d22-8cad-e070bd0296dc /slave:avg...
- '%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\icarus_ui.exe' /sssid:2644 /er_master:master_ep_9c1b1679-ecd9-4856-ac30-7b5904cad551 /er_ui:ui_ep_b389a2d6-9ef2-4d96-95a9-672f581bb1bf
- '%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\icarus.exe' /sssid:2644 /er_master:master_ep_9c1b1679-ecd9-4856-ac30-7b5904cad551 /er_ui:ui_ep_b389a2d6-9ef2-4d96-95a9-672f581bb1bf /er_slave:avg-tu_slave_ep_a2fdf823-9132-4d22-8cad-e070bd0296dc /slave:avg...' (with hidden window)
- '%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\icarus_ui.exe' /sssid:2644 /er_master:master_ep_9c1b1679-ecd9-4856-ac30-7b5904cad551 /er_ui:ui_ep_b389a2d6-9ef2-4d96-95a9-672f581bb1bf' (with hidden window)
