Trojan.DownLoader36.50561

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\privax\icarus\logs\sfx.log.tmp.de5b6f78-5eaa-4fce-ba0e-6c9d87593fbf
%ALLUSERSPROFILE%\privax\icarus\logs\icarus.log.tmp.c2b6b4f1-6bdd-457d-bdc8-afe86dd28dcb
%ALLUSERSPROFILE%\privax\icarus\logs\icarus.log
%ALLUSERSPROFILE%\privax\icarus\logs\report.log
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\privax-vpn\icarus.exe
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\privax-vpn\icarus_ui.exe
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\privax-vpn\icarus_rvrt.exe
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\common\icarus_rvrt.exe
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\privax-vpn\icarus_product.dll
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\privax-vpn\bug_report.exe
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\privax-vpn\product-def.xml
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\privax-vpn\setupui.cont
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\privax-vpn\product-info.xml
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\privax-vpn\config.def
<SYSTEM32>\icarus_rvrt.exe
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\ecoo.edat
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\icarus-info.xml
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\common\setupui.cont
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\common\5a62d0c2-edaf-4614-b229-d17a190565ff
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\common\product-def.xml
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\common\77ef7aa0-2acb-4f19-9de0-43dc346e5737
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\common\product-info.xml
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\common\39ed1b27-34fd-48ae-b694-8b52f0cae8da
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\common\icarus.exe
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\common\2679c109-01a4-4faf-98e4-06be3c95676f
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\common\icarus_ui.exe
%ALLUSERSPROFILE%\privax\icarus\logs\sui.log.tmp.d387e983-1da1-4f05-a35c-a5a8db9ea25c
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\privax-vpn\dump_process.exe
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\common\f22f094c-86f0-4cbb-91b6-82f7629cc4a1
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\common\icarus_product.dll
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\common\9f2867f5-7b76-4585-99a7-cd35939bd9b2
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\common\dump_process.exe
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\common\73cf454f-60b5-4d2d-a9a7-961dcfad7c9b
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\common\bug_report.exe
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\common\8c47b74f-6c61-4a8e-92b7-334b62d31459
%ALLUSERSPROFILE%\privax\icarus\logs\sfx.log
%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\common\fc732894-db77-40ad-913d-bf6a8153080e
%ALLUSERSPROFILE%\privax\icarus\logs\sui.log

Moves the following files

from %ALLUSERSPROFILE%\privax\icarus\logs\sfx.log.tmp.de5b6f78-5eaa-4fce-ba0e-6c9d87593fbf to %ALLUSERSPROFILE%\privax\icarus\logs\sfx.log
from %ALLUSERSPROFILE%\privax\icarus\logs\icarus.log.tmp.c2b6b4f1-6bdd-457d-bdc8-afe86dd28dcb to %ALLUSERSPROFILE%\privax\icarus\logs\icarus.log
from %ALLUSERSPROFILE%\privax\icarus\logs\sui.log.tmp.d387e983-1da1-4f05-a35c-a5a8db9ea25c to %ALLUSERSPROFILE%\privax\icarus\logs\sui.log

Network activity

Connects to

'an#####cs.ff.avast.com':443
'ho####.avcdn.net':443
'ho####.avcdn.net':80
'sh#####d.ff.avast.com':443

TCP

'an#####cs.ff.avast.com':443
'ho####.avcdn.net':443
'sh#####d.ff.avast.com':443

UDP

DNS ASK an#####cs.ff.avast.com
DNS ASK ho####.avcdn.net
DNS ASK sh#####d.ff.avast.com

Miscellaneous

Creates and executes the following

'%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\icarus-info.xml /install /sssid:2464
'%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\privax-vpn\icarus.exe' /sssid:2464 /er_master:master_ep_98b55ea4-ac3a-4fbb-97da-aacdf6b6b7c4 /er_ui:ui_ep_fb8d25b7-e026-431f-9171-99c816ae5b95 /er_slave:privax-vpn_slave_ep_a7ae72ab-1c08-4db5-a195-c0ead84c8533 /slave...
'%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\common\icarus_ui.exe' /sssid:2464 /er_master:master_ep_98b55ea4-ac3a-4fbb-97da-aacdf6b6b7c4 /er_ui:ui_ep_fb8d25b7-e026-431f-9171-99c816ae5b95
'%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\privax-vpn\icarus.exe' /sssid:2464 /er_master:master_ep_98b55ea4-ac3a-4fbb-97da-aacdf6b6b7c4 /er_ui:ui_ep_fb8d25b7-e026-431f-9171-99c816ae5b95 /er_slave:privax-vpn_slave_ep_a7ae72ab-1c08-4db5-a195-c0ead84c8533 /slave...' (with hidden window)
'%WINDIR%\temp\asw-0b982d9c-8665-4bce-88ac-bb2b97418b07\common\icarus_ui.exe' /sssid:2464 /er_master:master_ep_98b55ea4-ac3a-4fbb-97da-aacdf6b6b7c4 /er_ui:ui_ep_fb8d25b7-e026-431f-9171-99c816ae5b95' (with hidden window)