Gen:Variant.Downloader.167
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 12,897 |
| Threat Level: | 90 % (High) |
| Infected Computers: | 102 |
| First Seen: | May 29, 2014 |
| Last Seen: | August 7, 2026 |
| OS(es) Affected: | Windows |
The Gen:Variant.Downloader.167 Trojan has caught the attention of PC security analysts, not least because Gen:Variant.Downloader.167 includes a bible quote in its attack. Gen:Variant.Downloader.167 is distributed using IM (Instant Messaging) platforms such as Yahoo and the Facebook chat. Malware analysts have detected Gen:Variant.Downloader.167 attacks throughout Europe in the last few weeks and, more recently, in the United States and Canada. Gen:Variant.Downloader.167 is disguised as an instant message from an online contact inviting the computer user to download an application to view certain pictures. This supposed application contains threatening code that compromises the victim's computer and attempts to spread to the victim's online contacts. Gen:Variant.Downloader.167 affects computers using the Windows operating system and uses instant messaging platforms to spread from one victim to another.
Table of Contents
The Unique Characteristics of Gen:Variant.Downloader.167
One particularly unusual feature of Gen:Variant.Downloader.167 is that Gen:Variant.Downloader.167 uses verses from the bible as the decryption keys for Gen:Variant.Downloader.167's data. So far, Gen:Variant.Downloader.167 uses verses from the first epistle of Paul to the Corinthians, hiding its data between Bible verses and using an encryption algorithm. This is a curious feature that does not seem to be present in other threats, although it may not mean anything. PC security analysts believe that Gen:Variant.Downloader.167 is used to generating money from collected information and distribution of other threats.
How Third Parties may Profit from Gen:Variant.Downloader.167
The main goal of a Gen:Variant.Downloader.167 infection is to profit by gathering information that may be sold to a third party. Gen:Variant.Downloader.167 or threats associated with Gen:Variant.Downloader.167 may gather information such as online banking data or online passwords. This data is transmitted to a third party and then may be sold to ill-minded persons for use in online hoaxes and identity theft. These types of tactics pop up regularly on Facebook. In 2013, there was a widely distributed threat infection that also spread through Facebook using instant messages promising naked pictures to the victim's Facebook contacts. Computer users should be educated to spot these types of obvious deceiving tactics to avoid infecting their computers through threatening links spread using social engineering.
Analysis Report
General information
| Family Name: | Trojan.Upatre.WV |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
ab1f626c7cf7f99b33db2185b945a7c2
SHA1:
34457f997b70181fe327b4be771d9eb902dbaf20
SHA256:
37CBD035036BDA1F1372EAFE73FC14AE244F124C4F389A51368F93298D186193
File Size:
17.99 KB, 17994 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have resources
- File doesn't have security information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Traits
- 2+ executable sections
- No Version Info
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 3 |
|---|---|
| Potentially Malicious Blocks: | 1 |
| Whitelisted Blocks: | 1 |
| Unknown Blocks: | 1 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
