Home / malwarePDF  

PUA:Win32/Bandoo


First posted on 23 June 2016.
Source: Microsoft

Aliases :

There are no other names known for PUA:Win32/Bandoo.

Explanation :

Installation

This application can be downloaded from websites that offer third-party software downloads. For example, we have seen it downloaded from:

  • dl.cdn.torchbrowser.com
  • download.cdn.savevid.com
  • dl.cdn.chip.de
  • download.cdn.torchbrowser.com
  • ec.ccm2.net


We have seen this application use the following file names:
  • iLividSetup.exe
  • TorchSetup.exe
  • TorchSetup-r20-n-bc.exe
  • iLividSetupV1.exe
  • iLividSetup-r1734-n-bc.exe
  • BandooV8.exe
  • iLividSetup-r400-n-bc.exe
  • iLividSetup-r362-n-bc.exe
  • SavevidSetup-r0-n-bc.exe
  • iLividSetup-r484-n-bc.exe


It can be digitally signed by the following vendors:
  • Bandoo Media Inc
  • Bandoo Media. Inc
  • Torch Media Inc.
  • Bandoo Media. Inc.
  • Koyote-Lab Inc.


We have seen this application using product names such as:
  • iLivid
  • Torch
  • iMesh
  • jZip
  • BearShare


Payload

Exhibits suspicious behaviors

We have observed this application exhibit the following potentially unwanted behavior on PCs:
  • Installs programs that start automatically when your PC starts
  • Injects into other processes on your system
  • Modifies file associations on your system
  • Changes your browser's default new tab page settings
  • Installs extensions into your browsers - often this is used to inject ads, add toolbars, or change how your browser works
  • Changes your system hosts file - this is used to redirect or disable access to specific websites, and is often abused by suspicious applications to disable competitor websites or apps, security products, or updates


Installs other programs

We have seen this application install other software on your PC. Some of these applications might be bundled during the installation process and not intended to be installed. We have seen it installing programs such as:
  • Torch
  • BearShare
  • Movies Search App for Chrome
  • VLC media player
  • Movies Search App for Internet Explorer (Dist. by Torch Media. Inc.)
  • Savevid
  • Linkey
  • Movies Search App for Internet Explorer (Dist. by Bandoo Media. Inc.)
  • jZip
  • WinRAR 5.31 (64-bit)


This description was published using automated analysis.

Last update 23 June 2016

 

TOP

Malware :