Win32/Bifrose [Threat Name]

Detection created	2004-05-06
World activity peak	2008-07-16 (0.59 %)

The trojan serves as a backdoor. It can be controlled remotely.

When executed, the trojan copies itself in some of the the following locations:

The following Registry entry is set:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{%variable3%}]
- "stubpath" = "%copiedfilepath% s"

This causes the trojan to be executed on every system start.

The following Registry entries are created:

The trojan may set the following Registry entries:

[HKEY_CURRENT_USER\SOFTWARE\%variable4%]
- "delay" = "%variable6%"
- "plg1" = "%variable7%"
- "tor" = "%variable8%

A string with variable content is used instead of %variable1-8% .

The trojan may delete the following Registry entries:

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{%variable3%}]

The trojan launches the following processes:

The trojan creates and runs a new thread with its own code within these running processes.

Win32/Bifrose is a trojan that steals sensitive information.

The trojan collects the following information:

The trojan attempts to send gathered information to a remote machine.

The trojan serves as a backdoor. It can be controlled remotely.

The trojan acquires data and commands from a remote computer or the Internet.

The trojan contains a URL address. The TCP protocol is used.

It can execute the following operations:

The trojan hides its running process.

Threat Variants with Description