Backdoor.Bifrose.ACI (file analysis)

The Backdoor.Bifrose.ACI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Bifrose.ACI virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Attempts to modify desktop wallpaper
• Anomalous binary characteristics

How to determine Backdoor.Bifrose.ACI?

File Info:
name: 04873E4C822B6ED0E8E2.mlw
path: /opt/CAPEv2/storage/binaries/e7a0cadf19afca57a3127d7a517f426b0fd4bfd6ae702aa7360564ea1d4811b0
crc32: 5C470BD6
md5: 04873e4c822b6ed0e8e2f6fa5b416d4e
sha1: 8c1850d20a6ca54d2a608e4d8d9589fa130fd1ea
sha256: e7a0cadf19afca57a3127d7a517f426b0fd4bfd6ae702aa7360564ea1d4811b0
sha512: 5f00ecb004479f9736a23a91d0e513e9e871181c0a715dd7ec88a1946af9a560ae17cb268bf7d176187e04de404783977eddc9499b4c37306ce3a79096476597
ssdeep: 768:4VzTAI319fmgDbTIpKd9als2OACysguqT16qBkupM6ie9g5ZYj:yAufbTIAYOA0OT16qZ//
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F323F1265334FE20E99FE8BFA2BF81B641C25DF944436D50220186E292D8D53BCE6F47
sha3_384: 9113bcd11e288c6ae51d2a1194bee85eee6a4be17613efd5b9e0c64cf1e50ca16e505d25cd104b297c7b4aa1351abae9
ep_bytes: 558bec83ec4456ff15101040008bf08a
timestamp: 2006-12-01 19:03:19

Version Info:
0: [No Data]

Backdoor.Bifrose.ACI also known as:

How to remove Backdoor.Bifrose.ACI?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.