Trojan.DownLoader37.64605

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.6d47ca04-4b35-4d38-8c29-c413b0924d2d
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\ecoo.edat
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\icarus-info.xml
%ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.436e920b-e13d-49d5-94d1-466a1d135d24
%ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
%ALLUSERSPROFILE%\avast software\icarus\logs\report.log
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\avast-du\icarus.exe
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\avast-du\icarus_product.dll
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\avast-du\icarus_rvrt.exe
%ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.dbff393d-ed43-44b0-8847-b631044497ff
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\avast-du\dump_process.exe
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\avast-du\bug_report.exe
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\avast-du\product-def.xml
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\avast-du\setupui.cont
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\avast-du\product-info.xml
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\avast-du\config.def
<SYSTEM32>\icarus_rvrt.exe
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\trid.edat
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\avast-du\icarus_ui.exe
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\common\setupui.cont
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\common\e6259dc6-37b4-4d4c-ac9e-939d0115ee13
%ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\common\a8da04c9-1401-4e0d-9783-fb4ef4fe0fea
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\common\product-info.xml
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\common\5a1e53d5-d041-45b9-a410-a4ec0d5f70c2
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\common\icarus.exe
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\common\8c2c0d8d-f228-454d-88f8-4c384bb139d6
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\common\icarus_product.dll
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\common\icarus_ui.exe
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\common\product-def.xml
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\common\af734ee8-3fe4-4562-a35c-302fb13e824d
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\common\icarus_rvrt.exe
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\common\4fd5c045-28e7-486a-ab06-9014ad9ae043
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\common\dump_process.exe
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\common\e4c586f0-0d45-4fc8-9a4e-dcb8d12f8450
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\common\bug_report.exe
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\common\ddc3930d-7baf-479e-90bc-0d15d9314836
%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\common\80a2e539-061b-494e-b776-705f4ba56575
%ALLUSERSPROFILE%\avast software\icarus\logs\sui.log

Moves the following files

from %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.6d47ca04-4b35-4d38-8c29-c413b0924d2d to %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
from %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.436e920b-e13d-49d5-94d1-466a1d135d24 to %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
from %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.dbff393d-ed43-44b0-8847-b631044497ff to %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log

Network activity

Connects to

'an#####cs.ff.avast.com':443
'ho####.avcdn.net':443
'ho####.avcdn.net':80
'sh#####d.ff.avast.com':443

TCP

'an#####cs.ff.avast.com':443
'ho####.avcdn.net':443
'sh#####d.ff.avast.com':443

UDP

DNS ASK an#####cs.ff.avast.com
DNS ASK ho####.avcdn.net
DNS ASK sh#####d.ff.avast.com

Miscellaneous

Creates and executes the following

'%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\icarus-info.xml /install /sssid:2104
'%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\avast-du\icarus.exe' /sssid:2104 /er_master:master_ep_a064e9e3-794d-4e55-b447-8f68387d8495 /er_ui:ui_ep_e23bd86d-f1d3-4edb-aa95-08f0537486d9 /er_slave:avast-du_slave_ep_8f472a40-418a-40de-a698-55df5ff7cde0 /slave:a...
'%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\common\icarus_ui.exe' /sssid:2104 /er_master:master_ep_a064e9e3-794d-4e55-b447-8f68387d8495 /er_ui:ui_ep_e23bd86d-f1d3-4edb-aa95-08f0537486d9
'%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\avast-du\icarus.exe' /sssid:2104 /er_master:master_ep_a064e9e3-794d-4e55-b447-8f68387d8495 /er_ui:ui_ep_e23bd86d-f1d3-4edb-aa95-08f0537486d9 /er_slave:avast-du_slave_ep_8f472a40-418a-40de-a698-55df5ff7cde0 /slave:a...' (with hidden window)
'%WINDIR%\temp\asw-745dfa0e-8bf7-4992-82cd-fdea2b643562\common\icarus_ui.exe' /sssid:2104 /er_master:master_ep_a064e9e3-794d-4e55-b447-8f68387d8495 /er_ui:ui_ep_e23bd86d-f1d3-4edb-aa95-08f0537486d9' (with hidden window)