Upatre

Upatre is a Trojan downloader that is used to set up other threats on the victim's PC. Upatre has been used recently in several high profile Trojan attacks involving the Gameover Trojan. Trojan downloaders like Upatre are essential parts of threats distribution process. Trojans are characterized by the fact that they cannot distribute themselves or spread on their own. Unlike viruses, which corrupt executable files in order to ensure that they are multiplied on the victim's computer, or worms, which may use removable memory devices and other channels to spread from one computer to another, Trojans rely on the computer users themselves or on other threats to spread from one computer to another. In fact, the term 'Trojan' comes from the Trojan Horse, from the Iliad due to the fact that Trojans use similar tactics, entering a computer disguised as something beneficial and then releasing a payload or hidden harmful component. Trojan downloaders like Upatre are specific threats designed to deliver Trojan infections to the victim's computer, connecting to an outside server and downloading and setting up the threatening component on the victim's computer.

Attacks Associated with this Trojan Downloader

Security analysts have monitored attacks involving a group of criminals that carry out their operations using a modified version of the infamous ZeuS Trojan. This Trojan, known as Gameover, incorporates many of the ZeuS Trojans' known spy and banking functions but also leverages the power of peer-to-peer (P2P) networks to carry its attacks, spread from one computer to another and prevents detection. Recent attacks involving the Gameover Trojan have incorporated the use of the Upatre Trojan downloader to deliver Gameover to the victim's computer.

Upatre itself is contained in a very small file, and Upatre carries its operation in a way that is simple, straightforward and hard to detect. Basically, Upatre connects to a specific URL that uses an encrypted SSL connection to download and install the Gameover Trojan. Once this is done, Upatre deletes itself to prevent PC security researchers from studying and preventing this infection. Upatre itself is distributed using unsafe email attachments specifically designed to trick inexperienced computer users into opening unreliable files that include Upatre's unsafe code. Typical examples of unsafe email attachments include fake invoices or receipts attached to bogus emails from known businesses or popular institutions.

SpyHunter Detects & Remove Upatre