Trojan.DownLoader40.43256

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\privax\icarus\logs\sfx.log.tmp.c7820f1a-273a-49a9-86ac-a2cb45ed8937
%ALLUSERSPROFILE%\privax\icarus\logs\icarus.log.tmp.52f3254c-101f-4d0e-97bf-5ef88ad998b7
%ALLUSERSPROFILE%\privax\icarus\logs\icarus.log
%ALLUSERSPROFILE%\privax\icarus\logs\report.log
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\privax-vpn\icarus.exe
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\privax-vpn\icarus_ui.exe
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\privax-vpn\icarus_rvrt.exe
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\common\icarus_rvrt.exe
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\privax-vpn\icarus_product.dll
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\privax-vpn\bug_report.exe
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\privax-vpn\product-def.xml
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\privax-vpn\setupui.cont
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\privax-vpn\product-info.xml
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\privax-vpn\config.def
<SYSTEM32>\icarus_rvrt.exe
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\ecoo.edat
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\icarus-info.xml
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\common\setupui.cont
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\common\8ebcec3d-48c2-4905-a3df-cf5ed2c4a5e6
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\common\product-def.xml
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\common\0f72da7f-cc52-4d6a-9ca0-77f57518ac8a
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\common\product-info.xml
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\common\f2e7e7bb-e2e1-4873-9291-5f41704b1931
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\common\icarus.exe
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\common\4cb34224-30a7-45b9-9fd6-46fb1e8f2e23
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\common\icarus_ui.exe
%ALLUSERSPROFILE%\privax\icarus\logs\sui.log.tmp.2f09c746-f27f-48dd-ac6f-8a4e4f83a495
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\privax-vpn\dump_process.exe
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\common\fdb3602e-cae9-4b25-aaf1-b7ace07ee6ce
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\common\icarus_product.dll
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\common\eb7e8970-512a-493d-aea7-fa33d40e2e19
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\common\dump_process.exe
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\common\567b6f71-8148-4e29-b9b4-b6a9f31dab01
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\common\bug_report.exe
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\common\315cd895-5bfd-43d0-bdbb-67a989c4333d
%ALLUSERSPROFILE%\privax\icarus\logs\sfx.log
%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\common\e80db28d-61ef-4d31-9f65-07e76cd375c8
%ALLUSERSPROFILE%\privax\icarus\logs\sui.log

Moves the following files

from %ALLUSERSPROFILE%\privax\icarus\logs\sfx.log.tmp.c7820f1a-273a-49a9-86ac-a2cb45ed8937 to %ALLUSERSPROFILE%\privax\icarus\logs\sfx.log
from %ALLUSERSPROFILE%\privax\icarus\logs\icarus.log.tmp.52f3254c-101f-4d0e-97bf-5ef88ad998b7 to %ALLUSERSPROFILE%\privax\icarus\logs\icarus.log
from %ALLUSERSPROFILE%\privax\icarus\logs\sui.log.tmp.2f09c746-f27f-48dd-ac6f-8a4e4f83a495 to %ALLUSERSPROFILE%\privax\icarus\logs\sui.log

Network activity

Connects to

'an#####cs.ff.avast.com':443
'ho####.avcdn.net':443
'ho####.avcdn.net':80
'sh#####d.ff.avast.com':443

TCP

Other

'an#####cs.ff.avast.com':443
'ho####.avcdn.net':443
'sh#####d.ff.avast.com':443

UDP

DNS ASK an#####cs.ff.avast.com
DNS ASK ho####.avcdn.net
DNS ASK sh#####d.ff.avast.com

Miscellaneous

Creates and executes the following

'%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\icarus-info.xml /install /sssid:2452
'%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\privax-vpn\icarus.exe' /sssid:2452 /er_master:master_ep_c19e65a2-4cc1-40ae-b933-f6bdca85aa37 /er_ui:ui_ep_b25f891a-7ca8-4288-b2bc-d989f3d1b5fc /er_slave:privax-vpn_slave_ep_2ded78af-d64f-4f4c-ae75-ea093036fdd4 /slave...
'%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\common\icarus_ui.exe' /sssid:2452 /er_master:master_ep_c19e65a2-4cc1-40ae-b933-f6bdca85aa37 /er_ui:ui_ep_b25f891a-7ca8-4288-b2bc-d989f3d1b5fc
'%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\privax-vpn\icarus.exe' /sssid:2452 /er_master:master_ep_c19e65a2-4cc1-40ae-b933-f6bdca85aa37 /er_ui:ui_ep_b25f891a-7ca8-4288-b2bc-d989f3d1b5fc /er_slave:privax-vpn_slave_ep_2ded78af-d64f-4f4c-ae75-ea093036fdd4 /slave...' (with hidden window)
'%WINDIR%\temp\asw-75caa633-aaae-4ac9-88cb-e9c6f8faf355\common\icarus_ui.exe' /sssid:2452 /er_master:master_ep_c19e65a2-4cc1-40ae-b933-f6bdca85aa37 /er_ui:ui_ep_b25f891a-7ca8-4288-b2bc-d989f3d1b5fc' (with hidden window)