File name:

Bifrost v1.2.exe.zip

Full analysis: https://app.any.run/tasks/e2c097df-674c-4ebd-8a74-dac7e6158fc5
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: July 07, 2025, 22:07:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
bifrost
rat
upx
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

BBB0F0271F2857C434D2520109196D82

SHA1:

D68B0B55AE014C65A1A60247EE8ACF1D4A12CFCD

SHA256:

06A8D16D3E60FD26649B2802FBF5AE3185EC17F06EC969B53F157FE6AF119518

SSDEEP:

24576:2c49CD9cdujMFaYFfnJBF0ejSmwo0hzGzcRg2ycsUGArsPq9:2c49CpcdujMFaYFfnJBF0ejSmwo0hzGE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • BIFROST mutex has been found

      • server.exe (PID: 2864)
      • Bifrost v1.2.exe (PID: 2780)
      • explorer.exe (PID: 1452)
      • iexplore.exe (PID: 1504)

    • Runs injected code in another process

      • server.exe (PID: 2864)

    • Application was injected by another process

      • explorer.exe (PID: 1452)

    • Changes the autorun value in the registry

      • explorer.exe (PID: 1452)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • Bifrost v1.2.exe (PID: 2780)

    • Executable content was dropped or overwritten

      • Bifrost v1.2.exe (PID: 2780)
      • explorer.exe (PID: 1452)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3516)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 3516)
      • explorer.exe (PID: 1452)

    • Reads the Internet Settings

      • explorer.exe (PID: 1452)

    • Manual execution by a user

      • Bifrost v1.2.exe (PID: 2780)
      • server.exe (PID: 2864)
      • iexplore.exe (PID: 1504)

    • Reads the computer name

      • Bifrost v1.2.exe (PID: 2780)

    • Checks supported languages

      • server.exe (PID: 2864)
      • Bifrost v1.2.exe (PID: 2780)

    • UPX packer has been detected

      • Bifrost v1.2.exe (PID: 2780)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 1452)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 1452)

    • Reads the machine GUID from the registry

      • Bifrost v1.2.exe (PID: 2780)

    • Launching a file from a Registry key

      • explorer.exe (PID: 1452)

    • Create files in a temporary directory

      • Bifrost v1.2.exe (PID: 2780)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0009
ZipCompression: Unknown (99)
ZipModifyDate: 2025:07:07 22:02:48
ZipCRC: 0x10bae4c3
ZipCompressedSize: 577715
ZipUncompressedSize: 603648
ZipFileName: Bifrost v1.2.exe.bin
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
5
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe #BIFROST bifrost v1.2.exe #BIFROST server.exe no specs #BIFROST iexplore.exe no specs #BIFROST explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
1452C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\zipfldr.dll
c:\program files\winrar\winrar.exe
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1504"C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2780"C:\Users\admin\Desktop\Bifrost v1.2.exe" C:\Users\admin\Desktop\Bifrost v1.2.exe
explorer.exe
User:
admin
Company:
http://www.chasenet.org
Integrity Level:
MEDIUM
Description:
Bifrost 1.2
Version:
1, 2, 0, 0
Modules
Images
c:\users\admin\desktop\bifrost v1.2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\gdi32.dll
2864"C:\Users\admin\Desktop\server.exe" C:\Users\admin\Desktop\server.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3516"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Bifrost v1.2.exe.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
43 794
Read events
39 755
Write events
4 022
Delete events
17

Modification events

(PID) Process:(1452) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000088518ADB286244A8D4792F8E408EF9000000000020000000000106600000001000020000000EAD766EABCA547D1CF953ADA42A44CF3E785C98A3881259481479CD7D8AC745A000000000E8000000002000020000000A56172650BF494DF7517ED3EF26608B7B908E7142F79D595D9FB7343DC935212300000004E0525E928E2BAED1722059BBE37FD15C73E9AC0670BF5D879B1E82E2B6BB3B34CE3863F630CC29815467FD2F267C98F40000000D9A355E96049F5FC88250681FF4BFCE5F63E97150D0F1C9D039FB55B9A00FA0A9ABC9AACA459D50DF5313559E5FDEB98DFC6407F736F1AE6849B8D7942A0FF48
(PID) Process:(1452) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList
Operation:writeName:MRUList
Value:
a
(PID) Process:(1452) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithProgids
Operation:writeName:WinRAR.ZIP
Value:
(PID) Process:(1452) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1452) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1452) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3516) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
Executable files
4
Suspicious files
0
Text files
0
Unknown types
4

Dropped files

PID
Process
Filename
Type
1452explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-msautomaticdestinations-ms
MD5:4926C04D3F299737869C3AE516116D4B
SHA256:86C30AAF16151351665EF2E706FC50F4044E6CBB19B64F6C0D6F84B94E41017C
2780Bifrost v1.2.exeC:\Users\admin\AppData\Local\Temp\oqhqqixtmpvc
MD5:8B9096762099E6F3FAAC93739F1F9457
SHA256:972BAE2E1749D251D7AEC3253714CA3F8530349592564C2EA86E927F6FB0632F
1452explorer.exeC:\Users\admin\Desktop\Bifrost v1.2.exeexecutable
MD5:F240704BF6FCFEED002A09D0BD99C4E0
SHA256:3EF08A361122944A1D07E2974FFFEE07AB2EB0586470B5FF9378C07FD2CCD691
1452explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\Bifrost v1.2.exe.zip.lnklnk
MD5:62D670DCC2EBAE6FBFBA7E2C6DB7E112
SHA256:AC2624B0EE1BC51395EEB7C9F8C51432C167240D2BBA4C46EBF1BF6A8B8E6EC8
2780Bifrost v1.2.exeC:\Users\admin\Desktop\server.exeexecutable
MD5:BBCC8F9CB6D3B37EF2D2493101D052FB
SHA256:D7E0895F74654511DBE04889F90190FF5E86F2145BE6DC11A9817D21A8A484C3
1452explorer.exeC:\Users\admin\AppData\Roaming\server.exeexecutable
MD5:C3035CA498A8DF6D72449B89EF8CF878
SHA256:E0506095912C12D66DF6C7F85CDDB9C4F44E6BECD1A4C5CE8B95C7219FDC47F1
1452explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\290532160612e071.automaticDestinations-msautomaticdestinations-ms
MD5:213D05B2121186D5164BE8EC2CC5916C
SHA256:A50ED6D592B4236BC60BEA5A49E52279A58A795633780BD843F3D2E18A464F7E
3516WinRAR.exeC:\Users\admin\Desktop\Bifrost v1.2.exe.binexecutable
MD5:F240704BF6FCFEED002A09D0BD99C4E0
SHA256:3EF08A361122944A1D07E2974FFFEE07AB2EB0586470B5FF9378C07FD2CCD691
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.174
whitelisted

Threats

No threats detected
Process
Message
Bifrost v1.2.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Bifrost v1.2.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Bifrost v1.2.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Bifrost v1.2.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Bifrost v1.2.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Bifrost v1.2.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Bifrost v1.2.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Bifrost v1.2.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Bifrost v1.2.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Bifrost v1.2.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Bifrost v1.2.exe.zip