Categories: Backdoor

About “Backdoor.Win32.Bifrose.fsi” infection

The Backdoor.Win32.Bifrose.fsi is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.Bifrose.fsi virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Yara rule detections observed from a process memory dump/dropped files/CAPE
Reads data out of its own binary image
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Attempts to interact with an Alternate Data Stream (ADS)
Anomalous binary characteristics

How to determine Backdoor.Win32.Bifrose.fsi?


File Info:
name: ECB3AE26EDA2F6F80B2D.mlwpath: /opt/CAPEv2/storage/binaries/d4f9f062e4ffd5bdc1e4ecfa9ac24c81eeb145853cf2dfeded1a7271f7aef018crc32: 6E42632Fmd5: ecb3ae26eda2f6f80b2dd4d4dfa1cce1sha1: 9516569175fba022949cbf998beb0dc95de3c901sha256: d4f9f062e4ffd5bdc1e4ecfa9ac24c81eeb145853cf2dfeded1a7271f7aef018sha512: b462652cf6891f555ce99db5e02777aa1be266185d62386a829ec4c212dc0a145079ad9135990539bbe8b408bd11258369084f53110313da816788e63e815c09ssdeep: 3072:HUDoVPGlDndiJXli3wVsIu+UBW48nRwLuhZscMND5wdCYaR+d0:goVPGl7dmZyID48DZ6D+UYag0type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T13E0401617988249DD7671B71AE15D426B65E8E0B0F34849FD4CAB03EB4310E3C8F7AADsha3_384: 5622b23c308c583469875c55f6e24aa5cc007b468e9fef2b55b002a16d4ab6575df08285ac5b76c1d0e3fc7c40435aceep_bytes: 6a286870204000e87402000033ff57fftimestamp: 2010-10-10 13:42:54
Version Info:
FileDescription: Protected ApplicationFileVersion: 1, 0, 0, 1ProductVersion: 1, 0, 0, 1Comments: Is protected with Teggo MoleBox 4.2321Translation: 0x0000 0x04b0

Backdoor.Win32.Bifrose.fsi also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Refroso.muCm
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Refroso.2
ClamAV	Win.Trojan.Agent-36155
CAT-QuickHeal	VirTool.DelfInject.AF
ALYac	Gen:Variant.Refroso.2
Cylance	Unsafe
Zillya	Trojan.Refroso.Win32.29401
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 001788e91 )
Alibaba	Backdoor:Win32/Bifrose.0df9fadc
K7GW	Trojan ( 001788e91 )
Cybereason	malicious.6eda2f
Cyren	W32/VBInject.V.gen!Eldorado
Symantec	Backdoor.Bifrose!gen
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Packed.MoleboxUltra suspicious
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Backdoor.Win32.Bifrose.fsi
BitDefender	Gen:Variant.Refroso.2
NANO-Antivirus	Trojan.Win32.Refroso.tmkzo
SUPERAntiSpyware	Trojan.Agent/Gen-Crypt
Avast	Win32:Evo-gen [Trj]
Tencent	Win32.Backdoor.Bifrose.Uimw
Ad-Aware	Gen:Variant.Refroso.2
TACHYON	Backdoor/W32.Bifrose.176741.D
Emsisoft	Gen:Variant.Refroso.2 (B)
Comodo	Malware@#3c9h4s29ailr
F-Secure	Trojan:W32/Agent.DQKQ
DrWeb	Trojan.Inject1.30808
VIPRE	Gen:Variant.Refroso.2
TrendMicro	TROJ_BREDLAB.SMD
McAfee-GW-Edition	BehavesLike.Win32.Generic.cc
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.ecb3ae26eda2f6f8
Sophos	ML/PE-A + Mal/BigMole-B
Ikarus	Trojan.Win32.Refroso
GData	Gen:Variant.Refroso.2
Jiangmin	Trojan/Buzus.agja
Webroot	W32.Bifrose.Gen
Avira	TR/Crypt.XPACK.Gen
Antiy-AVL	Trojan/Win32.Refroso.a
Arcabit	Trojan.Refroso.2
ViRobot	Trojan.Win32.A.Refroso.176741.D
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
AhnLab-V3	Trojan/Win32.Bifrose.R1707
Acronis	suspicious
McAfee	Artemis!ECB3AE26EDA2
MAX	malware (ai score=99)
VBA32	Trojan.Tiggre
Malwarebytes	Trojan.MalPack.Generic
TrendMicro-HouseCall	TROJ_BREDLAB.SMD
Rising	Malware.Undefined!8.C (TFE:5:eo33Jqnx9TV)
Yandex	Trojan.GenAsa!XMiXPNBz8gY
SentinelOne	Static AI – Malicious PE
MaxSecure	Packed.Rebhip.a
Fortinet	W32/Refroso.BKBI!tr
BitDefenderTheta	AI:Packer.3423253E1E
AVG	Win32:Evo-gen [Trj]
Panda	Generic Malware
CrowdStrike	win/malicious_confidence_100% (D)