Should I remove “BScope.Trojan.Upatre”?

The BScope.Trojan.Upatre is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What BScope.Trojan.Upatre virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Creates RWX memory
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• Drops a binary and executes it
• Unconventionial binary language: Polish
• Unconventionial language used in binary resources: Polish
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavior consistent with a dropper attempting to download the next stage.
• Attempts to modify proxy settings
• Mimics icon used for popular non-executable file format
• Anomalous binary characteristics

How to determine BScope.Trojan.Upatre?

File Info:
name: E2E0BA6ABE67A8749C38.mlw
path: /opt/CAPEv2/storage/binaries/358941b88e32f576602cec7a60df7f5b77ccbf4843062507317e8c2bad842585
crc32: 8DC0689F
md5: e2e0ba6abe67a8749c384a3a2a369e28
sha1: 845a0e6ee6907c3dd6f94de5d889281647be8af8
sha256: 358941b88e32f576602cec7a60df7f5b77ccbf4843062507317e8c2bad842585
sha512: e665f4c2c789c401f78ec02627bac4d62348fcb0e68566f03643fdd13807555332c1b64347e252f2a98035f3f88e26e6768587e24f4366255105dae313a95a02
ssdeep: 768:SIyNti8a64zSyBqPBfogeglNPflcuzTEAu1Zc5U:1otpadvBgBfiglNPN1nMZc5U
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17F13A17156C90266E7768F3CC1B2A6C65266BE217EF2F44F9C8072C45F336C1A9F0A16
sha3_384: b8693dbaaef984df98f9eea2d498e196c807946017837a5f0169a45be857608dc0154340f765c953764d9331f372c7b4
ep_bytes: 558bec83ec44a1246a400085c0740aff
timestamp: 2013-10-12 06:24:18

Version Info:
CompanyName: Winapp
FileDescription: Winapp
FileVersion: 1.1.2.17
InternalName: WinappInternal
LegalCopyright: 
LegalTrademarks: 
OriginalFilename: 
ProductName: Winapp
ProductVersion: 2.17
Translation: 0x0415 0x04e4

BScope.Trojan.Upatre also known as:

How to remove BScope.Trojan.Upatre?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.