Categories: Malware

Win32/Bifrose.ADR malicious file

The Win32/Bifrose.ADR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Bifrose.ADR virus can do?

A file was accessed within the Public folder.
Sample contains Overlay data
Uses Windows utilities for basic functionality
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Russian
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Win32/Bifrose.ADR?


File Info:
name: CF062DD69FD7F8A95AB9.mlwpath: /opt/CAPEv2/storage/binaries/26a2d632c5b1e5a7c555b24dfa1942ad9ba5df83562ca968b84c08bc68fe16eecrc32: A7CD2463md5: cf062dd69fd7f8a95ab91d24aa84bcafsha1: 0d050f277b944420fc00baf77fb3bfb1bc830ef0sha256: 26a2d632c5b1e5a7c555b24dfa1942ad9ba5df83562ca968b84c08bc68fe16eesha512: a555082d5b27d89cb94d0a655f4c8a8ad72ad56477013dfaab74ee3cb8adf59f03c2af33d80c4cc03eda215da1d9cf2a00b8faa6faa7518e3b24e98cdee3c56fssdeep: 3072:+KJZx3+tGqTsnACpvmEhgwqvJ+Bsl94Fy+owCojmWsfby2oIukInqj96xeD:+KrxiyLvmWVXGlWowlynNVL5YWtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1DD14BF25F9C08132D1110A795C07D668A93E7B142E781187B7CE4B9D5EBB2861E3D3FBsha3_384: 5b07db12589e91edcac9165597082ac595caf0c32546cfe613fb4113504c171ea77e1318502ea93304e4a0e93ab1c39eep_bytes: 558bec83c4f0b89c9a4100e8b8abfefftimestamp: 1992-06-19 22:22:17
Version Info:
Comments: CompanyName: Company                                                     FileDescription: jewss 1.00 Installation                                     FileVersion: 1.00                LegalCopyright: Company                                                                                             Translation: 0x0409 0x04e4

Win32/Bifrose.ADR also known as:

Bkav	W32.Common.B688362E
Lionic	Trojan.Win32.Bifrose.m!c
Elastic	malicious (moderate confidence)
MicroWorld-eScan	Trojan.Crypt.BH
FireEye	Trojan.Crypt.BH
CAT-QuickHeal	Backdoor.Bifrose.7730
Skyhigh	BehavesLike.Win32.Dropper.cc
McAfee	Artemis!CF062DD69FD7
Cylance	unsafe
Sangfor	Backdoor.Win32.Bifrose.Vrwu
K7AntiVirus	Trojan ( 000158851 )
Alibaba	Backdoor:Win32/Bifrose.3f22ce5e
K7GW	Trojan ( 004bff5e1 )
CrowdStrike	win/malicious_confidence_70% (W)
BitDefenderTheta	AI:Packer.16F2E3DC1F
Symantec	Trojan Horse
ESET-NOD32	Win32/Bifrose.ADR
APEX	Malicious
Kaspersky	Backdoor.Win32.Bifrose.bgn
BitDefender	Trojan.Crypt.BH
NANO-Antivirus	Trojan.Win32.Agent.cojafi
Avast	Win32:Agent-AAZQ [Trj]
Tencent	Win32.Backdoor.Bifrose.Itgl
Emsisoft	Trojan.Crypt.BH (B)
F-Secure	Backdoor.BDS/Bifrose.keiqw
DrWeb	Trojan.Siggen2.42888
VIPRE	Trojan.Crypt.BH
TrendMicro	TROJ_GEN.R03BC0DAT24
Sophos	Troj/Agent-JZZ
Ikarus	Trojan.Win32.Refroso
GData	Trojan.Crypt.BH
Jiangmin	Backdoor.Bifrose.alg
Google	Detected
Avira	BDS/Bifrose.keiqw
Varist	W32/Backdoor.HNRS-5187
Antiy-AVL	Trojan/Win32.Bifrose.adr
Kingsoft	malware.kb.a.989
Xcitium	Malware@#2u5o33km3y4lh
Arcabit	Trojan.Crypt.BH
ZoneAlarm	Backdoor.Win32.Bifrose.bgn
Microsoft	Backdoor:Win32/Bifrose.gen!C
Cynet	Malicious (score: 100)
VBA32	Backdoor.Bifrose
ALYac	Trojan.Crypt.BH
MAX	malware (ai score=100)
Malwarebytes	Generic.Malware/Suspicious
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R03BC0DAT24
Rising	Backdoor.Bifrose!1.A05C (CLASSIC)
Yandex	Trojan.Meredrop!c+0iR9j5ytM
MaxSecure	Trojan.Malware.26224.susgen
AVG	Win32:Agent-AAZQ [Trj]
Cybereason	malicious.77b944
DeepInstinct	MALICIOUS