File name:

Bifrost 1.2.1d.rar

Full analysis: https://app.any.run/tasks/be1eb339-fd79-4eab-954e-517011d68416
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: March 10, 2021, 11:52:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
keylogger
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32, flags: Solid
MD5:

E0543FAC9FF7A226A7814A8618B648E4

SHA1:

A56DD1AFA783130B9874B71C4B47F13D69B22989

SHA256:

BB851DD6D6C8AA7074BB5B3B4452C5E67374AB705BAE14274BDC1ED1DBB0D08E

SSDEEP:

24576:qBM6xiCzG3jp6jOzYInFjlQ6ulHYWVpnh30haGxMNrT:MtzG3l6IY+lQ6u9vh3Kq/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • BIFROST.EXE (PID: 2624)
      • THE ONE.EXE (PID: 3464)
      • IDMAN.exe (PID: 3468)

    • Changes the autorun value in the registry

      • THE ONE.EXE (PID: 3464)
      • IDMAN.exe (PID: 3468)

    • Changes the login/logoff helper path in the registry

      • THE ONE.EXE (PID: 3464)

  • SUSPICIOUS

    • Drops a file with too old compile date

      • Bifrost.exe (PID: 3468)

    • Executable content was dropped or overwritten

      • Bifrost.exe (PID: 3468)
      • THE ONE.EXE (PID: 3464)

    • Creates files in the user directory

      • THE ONE.EXE (PID: 3464)
      • IDMAN.exe (PID: 3468)

    • Writes files like Keylogger logs

      • Bifrost.exe (PID: 3468)

    • Starts itself from another location

      • THE ONE.EXE (PID: 3464)

  • INFO

    • Manual execution by user

      • Bifrost.exe (PID: 3468)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 914
UncompressedSize: 1606
OperatingSystem: Win32
ModifyDate: 2007:12:28 17:27:08
PackingMethod: Normal
ArchivedFileName: Bifrost 1.2.1d\readme.txt
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe no specs bifrost.exe bifrost.exe the one.exe idman.exe notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2496"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Bifrost 1.2.1d.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2624"C:\Users\admin\AppData\Local\Temp\BIFROST.EXE" C:\Users\admin\AppData\Local\Temp\BIFROST.EXE
Bifrost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Bifrost 1.2.1
Exit code:
0
Version:
1, 2, 1, 0
Modules
Images
c:\users\admin\appdata\local\temp\bifrost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
3220notepadC:\Windows\system32\notepad.exe—IDMAN.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\kernel32.dll
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3464"C:\Users\admin\AppData\Local\Temp\THE ONE.EXE" C:\Users\admin\AppData\Local\Temp\THE ONE.EXE
Bifrost.exe
User:
admin
Company:
Microsoft Corp.
Integrity Level:
MEDIUM
Description:
Remote Service Application
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\appdata\local\temp\the one.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
3468"C:\Users\admin\Desktop\Bifrost 1.2.1d\Bifrost.exe" C:\Users\admin\Desktop\Bifrost 1.2.1d\Bifrost.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\desktop\bifrost 1.2.1d\bifrost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3468"C:\Users\admin\AppData\Roaming\MSDCSC\IDMAN.exe" C:\Users\admin\AppData\Roaming\MSDCSC\IDMAN.exe
THE ONE.EXE
User:
admin
Company:
Microsoft Corp.
Integrity Level:
MEDIUM
Description:
Remote Service Application
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\appdata\local\temp\the one.exe
c:\windows\system32\wininet.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\urlmon.dll
c:\users\admin\appdata\local\temp\bifrost.exe
c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
c:\windows\system32\secur32.dll
c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
Total events
1 187
Read events
1 152
Write events
35
Delete events
0

Modification events

(PID) Process:(2496) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2496) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2496) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2496) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2496) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Bifrost 1.2.1d.rar
(PID) Process:(2496) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2496) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2496) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2496) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3468) Bifrost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
3
Suspicious files
0
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2496WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2496.48220\Bifrost 1.2.1d\Bifrost.exe —
MD5:—
SHA256:—
2496WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2496.48220\Bifrost 1.2.1d\default.set —
MD5:—
SHA256:—
3468IDMAN.exeC:\Users\admin\AppData\Roaming\dclogs\2021-03-10-4.dctext
MD5:—
SHA256:—
2496WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2496.48220\Bifrost 1.2.1d\readme.txttext
MD5:3415CF2D9CAB561590250FEEFB185A74
SHA256:CB380169FED62F06793D052554B7A5BF4B6BAFA530175C0675393E6CBE0DB082
3468Bifrost.exeC:\Users\admin\AppData\Local\Temp\BIFROST.EXEexecutable
MD5:DF396B39EFD0587AC3A3C3E870AD0479
SHA256:01B08C9188E3714A7C8F3C1AB21D237D979A5CAAD9F6A1FBDB12A9430FC99337
2496WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2496.48220\Bifrost 1.2.1d\eula.txttext
MD5:B9A11D55A323DA026B0ABE444A15DE3D
SHA256:57A2B333EF2295E9CC0A1A702AB43764435BAEE80AF5EA7B385919B636C281D0
3464THE ONE.EXEC:\Users\admin\AppData\Roaming\MSDCSC\IDMAN.exeexecutable
MD5:94C5B3199414B8FCA9F134724ACDD88E
SHA256:DACD09444E389359D406450312E5FE66A2EB62C5C03948C8E7890303A43EE536
3468Bifrost.exeC:\Users\admin\AppData\Local\Temp\THE ONE.EXEexecutable
MD5:94C5B3199414B8FCA9F134724ACDD88E
SHA256:DACD09444E389359D406450312E5FE66A2EB62C5C03948C8E7890303A43EE536
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
1
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
arrivals.ddns.net
  • —
malicious

Threats

PID
Process
Class
Message
1040
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
Process
Message
Bifrost.exe
C:\Users\admin\AppData\Local\Temp\BIFROST.EXE
Bifrost.exe
C:\Users\admin\AppData\Local\Temp\THE ONE.EXE
BIFROST.EXE
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
BIFROST.EXE
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
BIFROST.EXE
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
BIFROST.EXE
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
BIFROST.EXE
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
BIFROST.EXE
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
BIFROST.EXE
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
BIFROST.EXE
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Bifrost 1.2.1d.rar