Bifrose.SN is a variant of the Bifrose family of backdoors.
Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.
More scanning & removal options
More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.
You may also refer to the Knowledge Base on the F-Secure Community site for more information.
Installation to the System
When run, Bifrose.SN copies itself under %SysDir% directory using the name winampxp.exe. It installs the following registry key to make sure it will be executed next time the system is started:
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]"startkey" = "winampxp.exe"
After the installation, Bifrose.SN tries to locate a web browser and inject code into it. The injected code is the actual backdoor. The backdoor starts to communicate with the following servers using a specially crafted HTTP queries:
The servers can instruct the backdoor to execute the following actions:
- Basic file operations (copy, delete, rename, find, execute)
- Download/upload files
- Process operations (list, kill)
- Registry operations (create/delete keys/values)
- Create screenshots of the desktop
F-Secure Anti-Virus detects this malware with the following updates: