Upatre

By Domesticus in Trojans

Threat Scorecard

Threat Level: 80 % (High)
Infected Computers: 452
First Seen: June 22, 2015
Last Seen: May 22, 2023
OS(es) Affected: Windows

Upatre is a Trojan downloader that is used to set up other threats on the victim's PC. Upatre has been used recently in several high profile Trojan attacks involving the Gameover Trojan. Trojan downloaders like Upatre are essential parts of threats distribution process. Trojans are characterized by the fact that they cannot distribute themselves or spread on their own. Unlike viruses, which corrupt executable files in order to ensure that they are multiplied on the victim's computer, or worms, which may use removable memory devices and other channels to spread from one computer to another, Trojans rely on the computer users themselves or on other threats to spread from one computer to another. In fact, the term 'Trojan' comes from the Trojan Horse, from the Iliad due to the fact that Trojans use similar tactics, entering a computer disguised as something beneficial and then releasing a payload or hidden harmful component. Trojan downloaders like Upatre are specific threats designed to deliver Trojan infections to the victim's computer, connecting to an outside server and downloading and setting up the threatening component on the victim's computer.

Attacks Associated with this Trojan Downloader

Security analysts have monitored attacks involving a group of criminals that carry out their operations using a modified version of the infamous ZeuS Trojan. This Trojan, known as Gameover, incorporates many of the ZeuS Trojans' known spy and banking functions but also leverages the power of peer-to-peer (P2P) networks to carry its attacks, spread from one computer to another and prevents detection. Recent attacks involving the Gameover Trojan have incorporated the use of the Upatre Trojan downloader to deliver Gameover to the victim's computer.

Upatre itself is contained in a very small file, and Upatre carries its operation in a way that is simple, straightforward and hard to detect. Basically, Upatre connects to a specific URL that uses an encrypted SSL connection to download and install the Gameover Trojan. Once this is done, Upatre deletes itself to prevent PC security researchers from studying and preventing this infection. Upatre itself is distributed using unsafe email attachments specifically designed to trick inexperienced computer users into opening unreliable files that include Upatre's unsafe code. Typical examples of unsafe email attachments include fake invoices or receipts attached to bogus emails from known businesses or popular institutions.

SpyHunter Detects & Remove Upatre

File System Details

Upatre may create the following file(s):
# File Name MD5 Detections
1. BTncXViClhILVfH.exe fa1d581cd5997ee4854149c6ad5c044d 1
2. file.exe 2833485ee2d5f6d43e44c2c223c00d25 0
3. cmuxamaf.exe dab3c55d2942d57d096efb18ab53b39c 0
4. VAKS_B1A3.tmp 076464eafd55a39970cce66d5ca9d435 0
5. block_invoice_report.exe f3f26fc27d36c5cf3b3db901b591e0e7 0

Registry Details

Upatre may create the following registry entry or registry entries:
Regexp file mask
%APPDATA%\wendorio.exe
%TEMP%\budha.exe

Related Posts

Trending

Most Viewed

Loading...