PSA: If you downloaded “GifCam” (a program that was posted in /r/software twice now), you might want to scan your computer.

Important Security Notice: Potential Malware Risks Associated with “GifCam” Downloads

In recent developments within the software community, users are advised to exercise caution when downloading and installing the “GifCam” application, especially from unofficial sources. Although the original creator’s official site confirms the program is safe, reports have emerged indicating that certain third-party downloads may contain malicious payloads.

Background and Context

“GifCam” is a popular Windows utility used for creating animated GIFs. It has seen multiple posts across online forums, notably on Reddit’s /r/software. The creator’s original post (linked here) reassures users of its safety. However, a subsequent discussion (linked here) highlighted that versions downloaded from some sources may be compromised.

Independent investigations have confirmed that downloads from unofficial URLs, such as bahraniapps.com, can be malicious, potentially harboring malware that includes keyloggers and remote access trojans (RATs).

Confirmed Security Threats

Users who have downloaded GifCam from certain third-party sites should be aware of the following findings:

Malicious executable detection: Antivirus tools like Microsoft Security Essentials (MSE) have flagged suspicious files such as GifCam_selfextractor.exe as Backdoor:Win32/Fynloski.A, a known dangerous remote access Trojan also linked to DarkComet RAT variants.
Persistence mechanisms: The malware may create files such as bahranisoft.exe or extrctr.exe within the %APPDATA% directory and modify registry keys to ensure launch upon system startup, establishing persistent control.
Keylogging activity: Logs stored in the %APPDATA%\dclogs folder contain plaintext recordings of user activity, including keystrokes, clipboard contents, and application usage. These logs can reveal sensitive information such as passwords, credit card numbers, and personal communications.
Detection alerts: Various security tools, including MalwareBytes Anti-Malware and Microsoft Security Essentials, have detected and quarantined these malicious components, underscoring the risk.