Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log.tmp.ae1782c5-2221-4e32-8f45-d602ce5442d3
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\ecoo.edat
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\icarus-info.xml
- %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log.tmp.d9fd0cd5-250c-4dad-b9a2-71b9877df9b3
- %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log
- %ALLUSERSPROFILE%\avg\icarus\logs\report.log
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\avg-du\icarus.exe
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\avg-du\icarus_product.dll
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\avg-du\icarus_rvrt.exe
- %ALLUSERSPROFILE%\avg\icarus\logs\sui.log.tmp.a011f728-cf59-4cbf-b57f-f973faa2ba4c
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\avg-du\dump_process.exe
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\avg-du\bug_report.exe
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\avg-du\product-def.xml
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\avg-du\setupui.cont
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\avg-du\product-info.xml
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\avg-du\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\trid.edat
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\avg-du\icarus_ui.exe
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\common\setupui.cont
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\common\9eff65ee-827a-47ae-9b49-7f72ea0530ea
- %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\common\2e54fdd9-9836-45e4-a115-4855b3e2f8fc
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\common\product-info.xml
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\common\bfff849b-5a83-46d8-958b-470093f2c91a
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\common\icarus.exe
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\common\bb74d8b0-9a6f-4047-b63f-ca5adf53a4e1
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\common\icarus_product.dll
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\common\icarus_ui.exe
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\common\product-def.xml
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\common\85d86aa5-962d-4e54-8927-fe67e8eff881
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\common\389aeb5e-8ca7-4c61-a225-70b461dc44ce
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\common\dump_process.exe
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\common\f496880d-b3f6-4e21-9a25-f905613b5f64
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\common\bug_report.exe
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\common\b235d444-61f5-4c6a-afc3-3ffdcf372ddf
- %WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\common\872625b2-d824-440a-a3ab-9c55c117ec79
- %ALLUSERSPROFILE%\avg\icarus\logs\sui.log
Moves the following files
- from %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log.tmp.ae1782c5-2221-4e32-8f45-d602ce5442d3 to %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log
- from %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log.tmp.d9fd0cd5-250c-4dad-b9a2-71b9877df9b3 to %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log
- from %ALLUSERSPROFILE%\avg\icarus\logs\sui.log.tmp.a011f728-cf59-4cbf-b57f-f973faa2ba4c to %ALLUSERSPROFILE%\avg\icarus\logs\sui.log
Network activity
Connects to
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'ho####.avcdn.net':80
- 'sh#####d.ff.avast.com':443
TCP
Other
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'sh#####d.ff.avast.com':443
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\icarus-info.xml /install /sssid:2364
- '%WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\avg-du\icarus.exe' /sssid:2364 /er_master:master_ep_d6b3879c-a653-4677-b65f-5536b67e873f /er_ui:ui_ep_c64c1ea9-846c-4d54-91d3-560bf4ab29be /er_slave:avg-du_slave_ep_99cb8376-2e92-45e1-950c-6935de61f298 /slave:avg...
- '%WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\common\icarus_ui.exe' /sssid:2364 /er_master:master_ep_d6b3879c-a653-4677-b65f-5536b67e873f /er_ui:ui_ep_c64c1ea9-846c-4d54-91d3-560bf4ab29be
- '%WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\avg-du\icarus.exe' /sssid:2364 /er_master:master_ep_d6b3879c-a653-4677-b65f-5536b67e873f /er_ui:ui_ep_c64c1ea9-846c-4d54-91d3-560bf4ab29be /er_slave:avg-du_slave_ep_99cb8376-2e92-45e1-950c-6935de61f298 /slave:avg...' (with hidden window)
- '%WINDIR%\temp\asw-9c4b74e1-a123-4b98-be31-b22c1401b311\common\icarus_ui.exe' /sssid:2364 /er_master:master_ep_d6b3879c-a653-4677-b65f-5536b67e873f /er_ui:ui_ep_c64c1ea9-846c-4d54-91d3-560bf4ab29be' (with hidden window)
