Trojan.DownLoader39.64312

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'

Изменения в файловой системе

Создает следующие файлы

%ALLUSERSPROFILE%\avg\icarus\logs\sfx.log.tmp.9af0e05f-6f52-4229-a0f8-9c6e42e49978
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\ecoo.edat
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\icarus-info.xml
%ALLUSERSPROFILE%\avg\icarus\logs\icarus.log.tmp.31f8d631-8b57-416a-b9e8-934248b29ad8
%ALLUSERSPROFILE%\avg\icarus\logs\icarus.log
%ALLUSERSPROFILE%\avg\icarus\logs\report.log
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\avg-tu\icarus.exe
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\avg-tu\icarus_product.dll
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\avg-tu\icarus_rvrt.exe
%ALLUSERSPROFILE%\avg\icarus\logs\sui.log.tmp.e84cefbb-1bfe-44b6-8591-8811e147718c
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\avg-tu\dump_process.exe
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\avg-tu\bug_report.exe
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\avg-tu\product-def.xml
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\avg-tu\setupui.cont
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\avg-tu\product-info.xml
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\avg-tu\config.def
<SYSTEM32>\icarus_rvrt.exe
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\trid.edat
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\avg-tu\icarus_ui.exe
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\common\setupui.cont
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\common\6a5c5139-f0a9-4bd5-8ff4-70a879d225ab
%ALLUSERSPROFILE%\avg\icarus\logs\sfx.log
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\common\5a86b1aa-e0f9-476e-9af6-6f68c289dc46
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\common\product-info.xml
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\common\4c61411a-7b8c-444d-aad4-02e85bd64414
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\common\icarus.exe
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\common\4a7dbcc3-a0d5-4e53-b6dd-841d9c81d7a1
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\common\icarus_product.dll
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\common\icarus_ui.exe
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\common\product-def.xml
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\common\749c0eea-0265-4872-bf12-024a1f8b19cd
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\common\icarus_rvrt.exe
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\common\540c6da4-1307-45e3-9831-724a2d6002a7
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\common\dump_process.exe
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\common\2edb3258-fabd-40e6-87ee-0ccc8797f015
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\common\bug_report.exe
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\common\185dad32-adea-4e24-9ba4-0afe83bff08d
%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\common\fcbe5e5c-6f86-4fad-bfd1-5cc529e44b8e
%ALLUSERSPROFILE%\avg\icarus\logs\sui.log

Перемещает следующие файлы

%ALLUSERSPROFILE%\avg\icarus\logs\sfx.log.tmp.9af0e05f-6f52-4229-a0f8-9c6e42e49978 в %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log
%ALLUSERSPROFILE%\avg\icarus\logs\icarus.log.tmp.31f8d631-8b57-416a-b9e8-934248b29ad8 в %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log
%ALLUSERSPROFILE%\avg\icarus\logs\sui.log.tmp.e84cefbb-1bfe-44b6-8591-8811e147718c в %ALLUSERSPROFILE%\avg\icarus\logs\sui.log

Сетевая активность

Подключается к

'an#####cs.ff.avast.com':443
'ho####.avcdn.net':443
'ho####.avcdn.net':80
'sh#####d.ff.avast.com':443

TCP

Другие

'an#####cs.ff.avast.com':443
'ho####.avcdn.net':443
'sh#####d.ff.avast.com':443

UDP

DNS ASK an#####cs.ff.avast.com
DNS ASK ho####.avcdn.net
DNS ASK sh#####d.ff.avast.com

Другое

Создает и запускает на исполнение

'%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\icarus-info.xml /install /sssid:1700
'%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\avg-tu\icarus.exe' /sssid:1700 /er_master:master_ep_ea1525c8-e613-42a5-b7b1-933ea246a8cd /er_ui:ui_ep_9dce310e-edc8-41c1-92b3-1efe26bc94b2 /er_slave:avg-tu_slave_ep_77021773-e7d5-4df4-ba81-2af9044f8515 /slave:avg...
'%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\common\icarus_ui.exe' /sssid:1700 /er_master:master_ep_ea1525c8-e613-42a5-b7b1-933ea246a8cd /er_ui:ui_ep_9dce310e-edc8-41c1-92b3-1efe26bc94b2
'%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\avg-tu\icarus.exe' /sssid:1700 /er_master:master_ep_ea1525c8-e613-42a5-b7b1-933ea246a8cd /er_ui:ui_ep_9dce310e-edc8-41c1-92b3-1efe26bc94b2 /er_slave:avg-tu_slave_ep_77021773-e7d5-4df4-ba81-2af9044f8515 /slave:avg...' (со скрытым окном)
'%WINDIR%\temp\asw-d402fce6-5aa3-4a5b-b7c4-721c9c729be4\common\icarus_ui.exe' /sssid:1700 /er_master:master_ep_ea1525c8-e613-42a5-b7b1-933ea246a8cd /er_ui:ui_ep_9dce310e-edc8-41c1-92b3-1efe26bc94b2' (со скрытым окном)