Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'msacm.bdmpeg' = 'bdmpega.acm'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.mpeg' = 'bdmpegv.dll'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.mjpg' = 'bdmjpeg.dll'
Malicious functions:
Executes the following:
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\BandiMPEG1\bdfilters64.dll"
- 'C:\~ctjqkit.tmp'
- '%TEMP%\~gearcyd.tmp' /S
- '%TEMP%\BDMPEG1SETUP.EXE' /S
Terminates or attempts to terminate
the following user processes:
- chrome.exe
- firefox.exe
- safari.exe
- iexplore.exe
- opera.exe
Modifies file system:
Creates the following files:
- %ProgramFiles%\Bandicam\lang\Serbian(Cyrillic).ini
- %ProgramFiles%\Bandicam\lang\Serbian.ini
- %ProgramFiles%\Bandicam\lang\Russian.ini
- %ProgramFiles%\Bandicam\lang\Portuguese(BR).ini
- %ProgramFiles%\Bandicam\lang\Romanian.ini
- %ProgramFiles%\Bandicam\lang\Simplified_Chinese.ini
- %ProgramFiles%\Bandicam\lang\Swedish.ini
- %ProgramFiles%\Bandicam\lang\Thai.ini
- %ProgramFiles%\Bandicam\lang\Spanish.ini
- %ProgramFiles%\Bandicam\lang\Slovak.ini
- %ProgramFiles%\Bandicam\lang\Slovenian.ini
- %ProgramFiles%\Bandicam\lang\Japanese.ini
- %ProgramFiles%\Bandicam\lang\Kurdish.ini
- %ProgramFiles%\Bandicam\lang\Italian.ini
- %ProgramFiles%\Bandicam\lang\Hungarian.ini
- %ProgramFiles%\Bandicam\lang\Indonesian.ini
- %ProgramFiles%\Bandicam\lang\Latvian.ini
- %ProgramFiles%\Bandicam\lang\Polish.ini
- %ProgramFiles%\Bandicam\lang\Portuguese.ini
- %ProgramFiles%\Bandicam\lang\Norwegian.ini
- %ProgramFiles%\Bandicam\lang\Lithuanian.ini
- %ProgramFiles%\Bandicam\lang\Malay.ini
- %ProgramFiles%\Bandicam\lang\Traditional_Chinese.ini
- %ALLUSERSPROFILE%\Start Menu\Programs\Bandicam\Bandicam.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Bandicam\BandiFix.lnk
- %ProgramFiles%\Bandicam\uninstall.exe
- <SYSTEM32>\D3DCompiler_47.dll
- %TEMP%\nsc7.tmp\System.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\Bandicam\Uninstall.lnk
- %TEMP%\aut8.tmp
- C:\~ctjqkit.tmp
- %TEMP%\nsc7.tmp\Dialer.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\Bandicam\Home page.url
- %ALLUSERSPROFILE%\Desktop\Bandicam.lnk
- %ProgramFiles%\Bandicam\lang\Uzbek.ini
- %ProgramFiles%\Bandicam\lang\Vietnamese.ini
- %ProgramFiles%\Bandicam\lang\Urdu.ini
- %ProgramFiles%\Bandicam\lang\Turkish.ini
- %ProgramFiles%\Bandicam\lang\Ukrainian.ini
- %ProgramFiles%\Bandicam\data\language.dat
- %ProgramFiles%\Bandicam\data\skin.dat
- <SYSTEM32>\vcomp140.dll
- %ProgramFiles%\Bandicam\data\effects.dat
- %ProgramFiles%\Bandicam\data\sample.png
- %ProgramFiles%\Bandicam\data\camera.wav
- %ProgramFiles%\Bandicam\bdcam.exe
- %ProgramFiles%\Bandicam\bdcam64.bin
- %ProgramFiles%\BandiMPEG1\uninstall.exe
- <SYSTEM32>\bdmpega.acm
- %TEMP%\nsd6.tmp\System.dll
- %ProgramFiles%\Bandicam\bdfix.exe
- %ProgramFiles%\Bandicam\bdcap64.dll
- %ProgramFiles%\Bandicam\bdcam.dll
- %ProgramFiles%\Bandicam\bdcap32.dll
- %ProgramFiles%\Bandicam\bdcamih.dll
- %ProgramFiles%\Bandicam\bandicam.ini
- %TEMP%\~gearcyd.tmp
- %TEMP%\BDMPEG1SETUP.EXE
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- %TEMP%\pdvfeud
- %TEMP%\nsc5.tmp
- <SYSTEM32>\bdmjpeg.dll
- <SYSTEM32>\bdmpegv.dll
- %ProgramFiles%\BandiMPEG1\bdfilters64.dll
- %TEMP%\bdfilters.dll
- %ProgramFiles%\BandiMPEG1\bdfilters.dll
- %ProgramFiles%\Bandicam\bdcam64.dll
- %ProgramFiles%\Bandicam\lang\English.ini
- %ProgramFiles%\Bandicam\lang\Farsi.ini
- %ProgramFiles%\Bandicam\lang\Dutch.ini
- %ProgramFiles%\Bandicam\lang\Czech.ini
- %ProgramFiles%\Bandicam\lang\Danish.ini
- %ProgramFiles%\Bandicam\lang\Finnish.ini
- %ProgramFiles%\Bandicam\lang\Greek.ini
- %ProgramFiles%\Bandicam\lang\Hebrew.ini
- %ProgramFiles%\Bandicam\lang\German.ini
- %ProgramFiles%\Bandicam\lang\French.ini
- %ProgramFiles%\Bandicam\lang\Georgian.ini
- %ProgramFiles%\Bandicam\amf-core-windesktop64.dll
- %ProgramFiles%\Bandicam\translators.txt
- %ProgramFiles%\Bandicam\amf-core-windesktop32.dll
- %ProgramFiles%\Bandicam\amf-component-vce-windesktop32.dll
- %ProgramFiles%\Bandicam\amf-component-vce-windesktop64.dll
- %ProgramFiles%\Bandicam\lang\Arabic.ini
- %ProgramFiles%\Bandicam\lang\Bulgarian.ini
- %ProgramFiles%\Bandicam\lang\Croatian.ini
- %ProgramFiles%\Bandicam\lang\Bosnian.ini
- %ProgramFiles%\Bandicam\lang\Armenian.ini
- %ProgramFiles%\Bandicam\lang\Azerbaijani.ini
Sets the 'hidden' attribute to the following files:
- C:\~ctjqkit.tmp
- %TEMP%\~gearcyd.tmp
Deletes the following files:
- %TEMP%\nsc7.tmp\System.dll
- %TEMP%\nsc7.tmp\Dialer.dll
- %TEMP%\aut8.tmp
- %TEMP%\~gearcyd.tmp
- C:\~ctjqkit.tmp
- %TEMP%\pdvfeud
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\BDMPEG1SETUP.EXE
- %TEMP%\nsd6.tmp\System.dll
Modifies the HOSTS file.
Miscellaneous:
Searches for the following windows:
- ClassName: 'Bandicam1.x' WindowName: ''
- ClassName: '' WindowName: 'Bandicam (Unregistered)'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Bandicam2.x' WindowName: ''
