Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.mjpg' = 'bdmjpeg.dll'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.mpeg' = 'bdmpegv.dll'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32] 'msacm.bdmpeg' = 'bdmpega.acm'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.mjpg' = 'bdmjpeg64.dll'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.mpeg' = 'bdmpegv64.dll'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'msacm.bdmpeg' = 'bdmpega64.acm'
- [<HKCU>\Software\Classes\BANDICAM.bfix\Shell\Open\Command] '' = '"%ProgramFiles%\Bandicam\bdfix.exe""%1"'
Вредоносные функции
Запускает на исполнение
- '<SYSTEM32>\taskkill.exe' /f /im "bdcam.exe"
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\rarsfx0\hook.exe
- %ProgramFiles%\bandicam\data\language.dat
- %ProgramFiles%\bandicam\lang\vietnamese.ini
- %ProgramFiles%\bandicam\lang\uzbek.ini
- %ProgramFiles%\bandicam\lang\urdu.ini
- %ProgramFiles%\bandicam\lang\ukrainian.ini
- %ProgramFiles%\bandicam\lang\turkish.ini
- %ProgramFiles%\bandicam\lang\traditional_chinese.ini
- %ProgramFiles%\bandicam\lang\thai.ini
- %ProgramFiles%\bandicam\lang\swedish.ini
- %ProgramFiles%\bandicam\lang\spanish.ini
- %ProgramFiles%\bandicam\lang\slovenian.ini
- %ProgramFiles%\bandicam\lang\slovak.ini
- %ProgramFiles%\bandicam\lang\khmer.ini
- %ProgramFiles%\bandicam\lang\sinhala.ini
- %ProgramFiles%\bandicam\lang\serbian.ini
- %ProgramFiles%\bandicam\lang\serbian(cyrillic).ini
- %ProgramFiles%\bandicam\lang\russian.ini
- %ProgramFiles%\bandicam\lang\romanian.ini
- %ProgramFiles%\bandicam\lang\portuguese(br).ini
- %ProgramFiles%\bandicam\lang\portuguese.ini
- %ProgramFiles%\bandicam\lang\polish.ini
- %ProgramFiles%\bandicam\lang\norwegian.ini
- %ProgramFiles%\bandicam\lang\malay.ini
- %ProgramFiles%\bandicam\lang\luxembourgish.ini
- %ProgramFiles%\bandicam\lang\lithuanian.ini
- %ProgramFiles%\bandicam\lang\latvian.ini
- %ProgramFiles%\bandicam\lang\simplified_chinese.ini
- %ProgramFiles%\bandicam\lang\kurdish.ini
- %ProgramFiles%\bandicam\data\language_bdfix.dat
- %ProgramFiles%\bandicam\data\effects\highlight30.dat
- nul
- %LOCALAPPDATA%\qb0e84b9.45\reset32.exe
- %LOCALAPPDATA%\qb0e84b9.45\bca.exe
- %TEMP%\0wuhl6rn.bat
- %ProgramFiles%\bandicam\msimg32.dll
- %TEMP%\nsg627b.tmp\dialer.dll
- C:\users\public\desktop\bandicam.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\bandicam\home page.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\bandicam\uninstall.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\bandicam\bandifix.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\bandicam\bandicam.lnk
- %ProgramFiles%\bandicam\uninstall.exe
- %ProgramFiles%\bandicam\data\camera.wav
- %ProgramFiles%\bandicam\data\sample.png
- %ProgramFiles%\bandicam\data\effects\highlight20.dat
- %ProgramFiles%\bandicam\data\effects\highlight15.dat
- %ProgramFiles%\bandicam\data\effects\highlight10.dat
- %ProgramFiles%\bandicam\data\effects\effects30.dat
- %ProgramFiles%\bandicam\data\effects\effects20.dat
- %ProgramFiles%\bandicam\data\effects\effects15.dat
- %ProgramFiles%\bandicam\data\effects\effects10.dat
- %ProgramFiles%\bandicam\data\skin.dat
- %ProgramFiles%\bandicam\data\stop.wav
- %ProgramFiles%\bandicam\data\start.wav
- %ProgramFiles%\bandicam\data\rclick.wav
- %ProgramFiles%\bandicam\data\lclick.wav
- %TEMP%\nsg627b.tmp\system.dll
- %ProgramFiles%\bandicam\lang\kazakh.ini
- %ProgramFiles%\bandicam\lang\japanese.ini
- %ProgramFiles%\bandicam\lang\italian.ini
- %ProgramFiles%\bandicam\bdcam_safemode.lnk
- %ProgramFiles%\bandicam\bdcam_nonadmin.lnk
- %ProgramFiles%\bandicam\bdcam_admin.lnk
- %ProgramFiles%\bandicam\bandicam.ini
- %ProgramFiles%\bandicam\bdcamih.dll
- %ProgramFiles%\bandicam\bdfix.exe
- %ProgramFiles%\bandicam\bdcam32.bin
- %ProgramFiles%\bandicam\bdcam.exe
- %ProgramFiles(x86)%\bandimpeg1\uninstall.exe
- <SYSTEM32>\bdmpega64.acm
- <SYSTEM32>\bdmpegv64.dll
- %ProgramFiles%\bandicam\bdcap64.dll
- <SYSTEM32>\bdmjpeg64.dll
- %WINDIR%\syswow64\bdmpega.acm
- %WINDIR%\syswow64\bdmpegv.dll
- %WINDIR%\syswow64\bdmjpeg.dll
- %ProgramFiles(x86)%\bandimpeg1\bdfilters64.dll
- %ProgramFiles(x86)%\bandimpeg1\bdfilters.dll
- %TEMP%\bdfilters.dll
- %TEMP%\nsa3fed.tmp
- %TEMP%\bdmpeg1setup.exe
- %TEMP%\rarsfx0\cyber.7z
- %TEMP%\rarsfx0\register.exe
- %TEMP%\rarsfx0\cybermania.url
- %TEMP%\rarsfx0\bdcamsetup.exe
- %TEMP%\nsa478c.tmp\system.dll
- %ProgramFiles%\bandicam\bdcam32.dll
- %ProgramFiles%\bandicam\bdcap32.dll
- %ProgramFiles%\bandicam\bdcam64.dll
- %ProgramFiles%\bandicam\lang\indonesian.ini
- %ProgramFiles%\bandicam\lang\croatian.ini
- %ProgramFiles%\bandicam\lang\hungarian.ini
- %ProgramFiles%\bandicam\lang\hebrew.ini
- %ProgramFiles%\bandicam\lang\greek.ini
- %ProgramFiles%\bandicam\lang\german.ini
- %ProgramFiles%\bandicam\lang\georgian.ini
- %ProgramFiles%\bandicam\lang\french.ini
- %ProgramFiles%\bandicam\lang\finnish.ini
- %ProgramFiles%\bandicam\lang\farsi.ini
- %ProgramFiles%\bandicam\lang\english.ini
- %ProgramFiles%\bandicam\lang\dutch.ini
- %ProgramFiles%\bandicam\lang\danish.ini
- %ProgramFiles%\bandicam\lang\czech.ini
- %ProgramFiles%\bandicam\lang\burmese.ini
- %ProgramFiles%\bandicam\bdcamvk32.dll
- %ProgramFiles%\bandicam\lang\bulgarian.ini
- %ProgramFiles%\bandicam\lang\bosnian.ini
- %ProgramFiles%\bandicam\lang\belarusian.ini
- %ProgramFiles%\bandicam\lang\azerbaijani.ini
- %ProgramFiles%\bandicam\lang\armenian.ini
- %ProgramFiles%\bandicam\lang\arabic.ini
- %ProgramFiles%\bandicam\translators.txt
- %ProgramFiles%\bandicam\unregvulkanlayer.bat
- %ProgramFiles%\bandicam\regvulkanlayer.bat
- %ProgramFiles%\bandicam\bdcamvk64.json
- %ProgramFiles%\bandicam\bdcamvk32.json
- %ProgramFiles%\bandicam\bdcamvk64.dll
- %APPDATA%\bandicam company\bandicam\version.ini
- %TEMP%\a60e.tmp\a60f.tmp\a610.bat
Присваивает атрибут 'скрытый' для следующих файлов
- %ProgramFiles%\bandicam\msimg32.dll
Удаляет следующие файлы
- %TEMP%\nsa478c.tmp\system.dll
- %TEMP%\bdmpeg1setup.exe
- %TEMP%\nsg627b.tmp\dialer.dll
- %TEMP%\nsg627b.tmp\system.dll
- %TEMP%\a60e.tmp\a60f.tmp\a610.bat
- %TEMP%\0wuhl6rn.bat
- %LOCALAPPDATA%\qb0e84b9.45\bca.exe
- %LOCALAPPDATA%\qb0e84b9.45\reset32.exe
- %TEMP%\rarsfx0\bdcamsetup.exe
- %TEMP%\rarsfx0\cyber.7z
- %TEMP%\rarsfx0\cybermania.url
- %TEMP%\rarsfx0\hook.exe
- %TEMP%\rarsfx0\register.exe
Сетевая активность
Подключается к
- 'ge###toway.com':443
- 'x1.#.lencr.org':80
- 'x2.#.lencr.org':80
- 'e1.#.lencr.org':80
TCP
Запросы HTTP GET
- http://x1.#.lencr.org/
- http://x2.#.lencr.org/
- http://e1.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTvkAFw3ViPKmUeIVEf3NC7b1ErqwQUWvPtK%2Fw2wjd5uVIw6lRvz1XLLqwCEgNjTyixZi%2F47JUm7fMDNF7Kaw%3D%3D
Другие
- 'ge###toway.com':443
UDP
- DNS ASK ge###toway.com
- DNS ASK microsoft.com
- DNS ASK x1.#.lencr.org
- DNS ASK x2.#.lencr.org
- DNS ASK e1.#.lencr.org
Другое
Ищет следующие окна
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Bandicam2.x' WindowName: ''
- ClassName: 'Bandicam1.x' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Static' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\rarsfx0\bdcamsetup.exe' /S
- '%TEMP%\bdmpeg1setup.exe' /S
- '%ProgramFiles%\bandicam\bdcam.exe' /install
- '%TEMP%\rarsfx0\hook.exe'
- '%TEMP%\rarsfx0\register.exe'
- '%ProgramFiles%\bandicam\bdcam.exe'
- '%LOCALAPPDATA%\qb0e84b9.45\bca.exe'
- '%LOCALAPPDATA%\qb0e84b9.45\reset32.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\0WUHL6RN.bat" "%TEMP%\RarSFX0\Register.exe" "' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\A60E.tmp\A60F.tmp\A610.bat %LOCALAPPDATA%\qb0E84B9.45\Reset32.exe"' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\BandiMPEG1\bdfilters64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\BandiMPEG1\bdfilters64.dll"
- '<SYSTEM32>\rundll32.exe' "%ProgramFiles%\Bandicam\bdcamvk64.dll",RegDll
- '%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles%\Bandicam\bdcamvk32.dll",RegDll
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\0WUHL6RN.bat" "%TEMP%\RarSFX0\Register.exe" "
- '<SYSTEM32>\ping.exe' localhost -n 6
- '<SYSTEM32>\cmd.exe' /S /D /c" echo cybermania@bandicam.com "
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\A60E.tmp\A60F.tmp\A610.bat %LOCALAPPDATA%\qb0E84B9.45\Reset32.exe"
- '<SYSTEM32>\reg.exe' delete HKCU\Software\BANDISOFT\BANDICAM\OPTION /v sUserInfo /f
- '<SYSTEM32>\reg.exe' delete HKCU\Software\BANDISOFT\BANDICAM\OPTION /v sUserInfo2 /f
- '<SYSTEM32>\reg.exe' delete HKCU\Software\BANDISOFT\BANDICAM\OPTION /v sUserData /f
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\BANDISOFT\BANDICAM\OPTION /v sCode /d 9843b4f4abf8c93b1746c123eb49e710 /f
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\BANDISOFT\BANDICAM\OPTION /v sCode2 /d aa43cef8f7fe6f8266e57e97d45db82cfd689cdf4e92acafa6e908809dc4477f8588a8cae78be3c5 /f
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\BANDISOFT\BANDICAM\OPTION /v sCode3 /d 5e6d711653d0ef1f8592a0d6f6e3d887 /f
- '<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\BANDISOFT\BANDICAM\OPTION /v sUserData /f
- '<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\BANDISOFT\BANDICAM\OPTION /v sUserInfo /f
