Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\rlicmwhba6vzkzdhto
- <SYSTEM32>\tasks\oracle corporation
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im atom.exe /f
Modifies file system
Creates the following files
- %TEMP%\nsp6f08.tmp
- %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
- %ALLUSERSPROFILE%\avast software\icarus\settings\proxy.ini
- %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.f9a5cb56-3f24-476e-a24a-cf07e4ea5d97
- %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log
- %ALLUSERSPROFILE%\avast software\icarus\logs\report.log
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\avast-vpn\icarus.exe
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\avast-vpn\icarus_ui.exe
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\icarus-info.xml
- %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.e640ded0-9b99-4b60-aa79-093158503be9
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\avast-vpn\dump_process.exe
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\avast-vpn\setupui.cont
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\avast-vpn\icarus_rvrt.exe.lzma
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\avast-vpn\icarus_rvrt.exe
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\avast-vpn\icarus_product.dll.lzma
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\avast-vpn\icarus_product.dll
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\avast-vpn\product-info.xml
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\avast-vpn\config.def
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\avast-vpn\bug_report.exe
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\avast-vpn\product-def.xml
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\ecoo.edat
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\common\setupui.cont
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\common\02a9da8c-0397-47c5-bdee-b0779eb8a4d7
- %APPDATA%\atom.exe
- %APPDATA%\avast_secureline_setup.exe
- %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.0c61d7b4-3a12-4ca4-9452-ac028c22fae8
- %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
- %ALLUSERSPROFILE%\{sg277p56-i3ft-gfbw-rlqgbxwdknek}\iexplore.exe
- %APPDATA%\java.exe
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\common\52a61e7e-168c-45c3-bdb7-c689b69229bf
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\common\product-info.xml
- %APPDATA%\bypass.vbs
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\common\69555172-caac-47ad-8dc5-b10008525fcd
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\common\362a3b49-bdaa-41aa-bd03-8ef29f1180e0
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\common\icarus_ui.exe
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\common\60f5e740-6962-4ce2-b953-e1d5106b1ab9
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\common\dump_process.exe
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\common\dfd6ab9c-c691-4a84-8f0d-000a9a650d89
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\common\bug_report.exe
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\common\8c151ad2-2820-4fe4-926b-82d97cd8753d
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\common\product-def.xml
- %WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\common\icarus.exe
- %TEMP%\mtvvzjyzcbje.xml
- %APPDATA%\dialer_javaapps\jre1.8.0_341\bin\dialer_java.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\bypass.vbs
- %APPDATA%\atom.exe
- %APPDATA%\avast_secureline_setup.exe
- %APPDATA%\java.exe
Deletes the following files
- %TEMP%\mtvvzjyzcbje.xml
Moves the following files
- from %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.0c61d7b4-3a12-4ca4-9452-ac028c22fae8 to %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
- from %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.e640ded0-9b99-4b60-aa79-093158503be9 to %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
- from %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.f9a5cb56-3f24-476e-a24a-cf07e4ea5d97 to %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log
Modifies the HOSTS file.
Network activity
Connects to
- 'an#####cs.ff.avast.com':443
- 'pk#.goog':80
- 'ho####.avcdn.net':443
- 'sh#####d.ff.avast.com':443
- 'si######gion.duckdns.org':80
TCP
HTTP GET requests
- http://pk#.goog/gsr1/gsr1.crt
Other
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'sh#####d.ff.avast.com':443
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK pk#.goog
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
- DNS ASK si######gion.duckdns.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%APPDATA%\atom.exe'
- '%APPDATA%\avast_secureline_setup.exe'
- '%ALLUSERSPROFILE%\{sg277p56-i3ft-gfbw-rlqgbxwdknek}\iexplore.exe'
- '%APPDATA%\java.exe'
- '%WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\icarus-info.xml /install /sssid:2312
- '%WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\common\icarus_ui.exe' /sssid:2312 /er_master:master_ep_3be07f55-9900-4cca-bbff-bdf7b691186a /er_ui:ui_ep_d50824cf-2b9a-41c9-be10-53ca710795c7
- '%WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\avast-vpn\icarus.exe' /sssid:2312 /er_master:master_ep_3be07f55-9900-4cca-bbff-bdf7b691186a /er_ui:ui_ep_d50824cf-2b9a-41c9-be10-53ca710795c7 /er_slave:avast-vpn_slave_ep_fe3d589c-381f-449b-9963-3008ee7f55ec /slave:...
- '%ALLUSERSPROFILE%\{sg277p56-i3ft-gfbw-rlqgbxwdknek}\iexplore.exe' ' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 15 /TN "RLICMWHBA6VZKZDHTO" /TR "%ALLUSERSPROFILE%\{SG277P56-I3FT-GFBW-RLQGBXWDKNEK}\iexplore.exe" /F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im atom.exe /f & erase ГCГёГЅ\user\AppData\Roaming\atom.exe & exit' (with hidden window)
- '%WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\common\icarus_ui.exe' /sssid:2312 /er_master:master_ep_3be07f55-9900-4cca-bbff-bdf7b691186a /er_ui:ui_ep_d50824cf-2b9a-41c9-be10-53ca710795c7' (with hidden window)
- '%WINDIR%\temp\asw-4df353b7-bc9c-4c31-95a3-bcbb86b4187e\avast-vpn\icarus.exe' /sssid:2312 /er_master:master_ep_3be07f55-9900-4cca-bbff-bdf7b691186a /er_ui:ui_ep_d50824cf-2b9a-41c9-be10-53ca710795c7 /er_slave:avast-vpn_slave_ep_fe3d589c-381f-449b-9963-3008ee7f55ec /slave:...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 15 /TN "RLICMWHBA6VZKZDHTO" /TR "%ALLUSERSPROFILE%\{SG277P56-I3FT-GFBW-RLQGBXWDKNEK}\iexplore.exe" /F
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\cmd.exe' /c choice /C Y /N /D Y /T 3 & Del "%APPDATA%\java.exe"
- '<SYSTEM32>\schtasks.exe' /run /tn "Oracle Corporation"
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\schtasks.exe' /create /f /tn "Oracle Corporation" /xml "%TEMP%\mtvvzjyzcbje.xml"
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\schtasks.exe' /delete /f /tn "Oracle Corporation"
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\cmd.exe' /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im atom.exe /f & erase ГCГёГЅ\user\AppData\Roaming\atom.exe & exit
- '<SYSTEM32>\choice.exe' /C Y /N /D Y /T 3
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
Uses NTFS alternate data streams
