Trojan.DownLoader37.21734

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'

Изменения в файловой системе

Создает следующие файлы

%ALLUSERSPROFILE%\avg\icarus\logs\sfx.log.tmp.47e917e7-0340-46b8-8c8c-8dbdcf192229
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\ecoo.edat
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\icarus-info.xml
%ALLUSERSPROFILE%\avg\icarus\logs\icarus.log.tmp.19e82e2d-2f51-4a65-a915-f4d026cec0ed
%ALLUSERSPROFILE%\avg\icarus\logs\icarus.log
%ALLUSERSPROFILE%\avg\icarus\logs\report.log
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\icarus.exe
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\icarus_product.dll
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\icarus_rvrt.exe
%ALLUSERSPROFILE%\avg\icarus\logs\sui.log.tmp.1fc48900-d078-4410-8e6b-85a3a4589fd4
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\dump_process.exe
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\bug_report.exe
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\product-def.xml
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\setupui.cont
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\product-info.xml
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\config.def
<SYSTEM32>\icarus_rvrt.exe
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\trid.edat
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\icarus_ui.exe
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\setupui.cont
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\ffd41767-1ea8-4aac-a9e2-be0a13bb128c
%ALLUSERSPROFILE%\avg\icarus\logs\sfx.log
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\17ed61be-1fdb-4e17-b8e0-25ccfcd1f79d
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\product-info.xml
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\143c8b4c-47c5-451a-8837-e6abc183eaf5
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\icarus.exe
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\328f893c-b661-4ecf-902d-63b7d471628b
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\icarus_product.dll
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\icarus_ui.exe
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\product-def.xml
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\54d62578-1526-4c87-bc8d-6040e0d17472
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\icarus_rvrt.exe
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\4ebe2232-0d82-49b2-8084-dc0f73a9b23d
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\dump_process.exe
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\4208f07d-1c00-45d4-b0ad-539f212c03f0
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\bug_report.exe
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\d0e1165b-a117-4334-8428-718d4ff86439
%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\ebe15063-d2cb-41c6-afea-adab45f90aa6
%ALLUSERSPROFILE%\avg\icarus\logs\sui.log

Перемещает следующие файлы

%ALLUSERSPROFILE%\avg\icarus\logs\sfx.log.tmp.47e917e7-0340-46b8-8c8c-8dbdcf192229 в %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log
%ALLUSERSPROFILE%\avg\icarus\logs\icarus.log.tmp.19e82e2d-2f51-4a65-a915-f4d026cec0ed в %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log
%ALLUSERSPROFILE%\avg\icarus\logs\sui.log.tmp.1fc48900-d078-4410-8e6b-85a3a4589fd4 в %ALLUSERSPROFILE%\avg\icarus\logs\sui.log

Сетевая активность

Подключается к

'an#####cs.ff.avast.com':443
'ho####.avcdn.net':443
'ho####.avcdn.net':80
'sh#####d.ff.avast.com':443

TCP

'an#####cs.ff.avast.com':443
'ho####.avcdn.net':443
'sh#####d.ff.avast.com':443

UDP

DNS ASK an#####cs.ff.avast.com
DNS ASK ho####.avcdn.net
DNS ASK sh#####d.ff.avast.com

Другое

Создает и запускает на исполнение

'%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\icarus-info.xml /install /sssid:2644
'%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\icarus.exe' /sssid:2644 /er_master:master_ep_9c1b1679-ecd9-4856-ac30-7b5904cad551 /er_ui:ui_ep_b389a2d6-9ef2-4d96-95a9-672f581bb1bf /er_slave:avg-tu_slave_ep_a2fdf823-9132-4d22-8cad-e070bd0296dc /slave:avg...
'%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\icarus_ui.exe' /sssid:2644 /er_master:master_ep_9c1b1679-ecd9-4856-ac30-7b5904cad551 /er_ui:ui_ep_b389a2d6-9ef2-4d96-95a9-672f581bb1bf
'%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\avg-tu\icarus.exe' /sssid:2644 /er_master:master_ep_9c1b1679-ecd9-4856-ac30-7b5904cad551 /er_ui:ui_ep_b389a2d6-9ef2-4d96-95a9-672f581bb1bf /er_slave:avg-tu_slave_ep_a2fdf823-9132-4d22-8cad-e070bd0296dc /slave:avg...' (со скрытым окном)
'%WINDIR%\temp\asw-4b8cb870-9739-47ab-ac0d-873a72a075f4\common\icarus_ui.exe' /sssid:2644 /er_master:master_ep_9c1b1679-ecd9-4856-ac30-7b5904cad551 /er_ui:ui_ep_b389a2d6-9ef2-4d96-95a9-672f581bb1bf' (со скрытым окном)