Trojan.Upatre.LB
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Threat Level: | 80 % (High) |
| Infected Computers: | 15 |
| First Seen: | September 6, 2024 |
| Last Seen: | October 17, 2026 |
| OS(es) Affected: | Windows |
Trojan.Upatre.LB is a dangerous Windows-based Trojan horse program designed to infiltrate computers quietly and open the door to further malicious activity. Rated at a high danger level, this threat is capable of giving attackers significant control over an infected system, making it a serious concern for both home users and businesses alike.
Table of Contents
What Trojan.Upatre.LB Does
Once it finds its way onto a system, Trojan.Upatre.LB installs itself stealthily and runs silently in the background, often without any obvious signs to alert the user. It is a 32-bit Windows executable that typically lacks digital signatures, version information, and other legitimate markers that normal software usually carries — a common trait among threats designed to evade detection and analysis.
This Trojan is known to use suspicious system functions, such as hooking into Windows processes, which can allow it to monitor activity, intercept data, or manipulate how other programs behave on the infected machine. After it establishes itself, Trojan.Upatre.LB can covertly delete files, download and install additional malware, and potentially hand over control of the compromised system to remote attackers.
How It Usually Gets Onto Computers
Trojan.Upatre.LB commonly spreads by exploiting system vulnerabilities and security flaws that have not been patched. It is also frequently distributed through malicious software downloads from compromised or untrustworthy websites. Another common delivery method is email — the Trojan can be disguised as attachments with extensions such as .exe, .pif, .avi, or even .jpg, tricking users into opening what appears to be a harmless file.
Because these files are often disguised to look legitimate or harmless, users may unknowingly execute the Trojan themselves simply by opening an attachment or downloading a file from an untrusted source.
Risks for the User
The consequences of a Trojan.Upatre.LB infection can be severe. Once active, this threat may allow cybercriminals to gain extensive control over the compromised computer. This can lead to the theft of sensitive information, unauthorized access to files, and the installation of additional malware such as ransomware, spyware, or other Trojans. Users may also experience system instability, performance issues, or unexpected changes to files and settings as a result of the infection.
Signs of Infection
Because Trojan.Upatre.LB is built to operate stealthily, it may not produce obvious symptoms right away. However, users should watch for warning signs such as:
- Unexplained system slowdowns or crashes
- Unusual network activity or increased data usage
- Files disappearing or being modified without explanation
- Unknown programs or processes running in the background
- Security software being disabled or malfunctioning unexpectedly
How to Stay Protected
To reduce the risk of infection from threats like Trojan.Upatre.LB, users should keep their operating system and all installed software fully updated, as this helps close security vulnerabilities that malware often exploits. Avoid downloading software from unofficial or suspicious websites, and never open email attachments from unknown or untrusted senders, especially files with executable extensions like .exe or .pif.
Maintaining regular backups of important files, using a reputable and up-to-date security solution, and exercising caution when browsing the internet or handling email attachments are essential steps toward protecting your system from this and similar Trojan threats.
Analysis Report
General information
| Family Name: | Trojan.Upatre.LB |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
6b51460eaa630d341a8bfb2afbc7a339
SHA1:
a6c4fb81f1971cbd7afd3e0d28573902685618e5
SHA256:
2E78FF9952BB11C542946A59B2C13EA77C85336DA3C4C63E0A1AC0124917F788
File Size:
278.53 KB, 278528 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have resources
- File doesn't have security information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Traits
- No Version Info
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 319 |
|---|---|
| Potentially Malicious Blocks: | 105 |
| Whitelisted Blocks: | 214 |
| Unknown Blocks: | 0 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Upatre.LB
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | a6c4fb81f1971cbd7afd3e0d28573902685618e5_0000278528 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::id | 話㤠 | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �n 8��"ajg�8 �� �v �� T��������%�� Bx #��$kF%�&� (�(X�(�)�`*J*9*�"-!R1`1�1HO 1��5,]=� @V� A��D�G�IH[uH�pK��N$N� a$b"hc�w g�Xh�rj�bk`k�ql(�lR p*q�Xr�BtǤvy�w�ny�9 | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �n � 8��"ajg�8 �� �v �� T��������%�� Bx #��$kF%�&� (�(X�(�)�`*J*9*�",=� -!R1`1�1HO 1��5,]=� @V� A��D�G�IH[uH�pK��N$N� a$b"hc�w g�Xh�rj�bk`k�ql(�lR p*q�Xr�BtǤvy�w�n | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Other Suspicious |
|