Malware

Troj/Upatre-YW removal instruction

Malware Removal

The Troj/Upatre-YW is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Troj/Upatre-YW virus can do?

  • Sample contains Overlay data
  • Performs HTTP requests potentially not found in PCAP.
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Authenticode signature is invalid
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Attempts to modify proxy settings

How to determine Troj/Upatre-YW?


File Info:

name: 3E1BD4042A8883F9DE87.mlw
path: /opt/CAPEv2/storage/binaries/949eb9ab4ea2ef3cc0c308fe9e8349627fef92e166e6f5d219e98e3cb9e8a4b0
crc32: 8A53037B
md5: 3e1bd4042a8883f9de87f8deb5832975
sha1: bb9e0b277c431323547489bef58d3404a8b93c79
sha256: 949eb9ab4ea2ef3cc0c308fe9e8349627fef92e166e6f5d219e98e3cb9e8a4b0
sha512: 748b6f08fcc35708c1ffb39b5031f25f661aed8c32799dab9f2291355f877c42123f95a4568948aacc482b76b6a3b4e96983d4cc8361e36b5d6cbfeabc0825ed
ssdeep: 192:3SXtoITW7I3FIZDDIIKIIORdmECi1PF+KDDsAQdm+eZv2PlSTbh78RPr:uoITKJ7mUt2n1
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11F7206743FE96A72F37BCFB586F552C5A975B0227C06D40D40AA43880823FA5DDB1A1E
sha3_384: c7e1eca48ace12482268a143acbef37280b0f9576abc461157e2e4635c0771c2ceb91ada569152d7c69c074dec776bec
ep_bytes: 558becb83c200000e863030000535657
timestamp: 2013-09-06 09:44:54

Version Info:

0: [No Data]

Troj/Upatre-YW also known as:

BkavW32.AIDetectNet.01
LionicTrojan.Win32.Upatre.4!c
AVGWin32:Downloader-WID [Trj]
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.Ppatre.Gen.1
FireEyeGeneric.mg.3e1bd4042a8883f9
ALYacTrojan.Ppatre.Gen.1
Cylanceunsafe
VIPRETrojan.Ppatre.Gen.1
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan-Downloader ( 0050fef41 )
AlibabaMalware:Win32/km_28d8f.None
K7GWTrojan-Downloader ( 0050fef41 )
CrowdStrikewin/malicious_confidence_100% (W)
BitDefenderThetaGen:NN.ZexaE.36308.bmY@ayjVPSi
VirITTrojan.Win32.Upatre.AJ
CyrenW32/Upatre.LX.gen!Eldorado
SymantecML.Attribute.HighConfidence
tehtrisGeneric.Malware
ESET-NOD32a variant of Win32/TrojanDownloader.Small.PRL
CynetMalicious (score: 100)
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Downloader.Upatre-9952018-0
KasperskyHEUR:Trojan-Downloader.Win32.Upatre.gen
BitDefenderTrojan.Ppatre.Gen.1
NANO-AntivirusTrojan.Win32.DownLoad3.dofdyx
AvastWin32:Downloader-WID [Trj]
TencentTrojan-DL.Win32.Small.yw
EmsisoftTrojan.Ppatre.Gen.1 (B)
F-SecureTrojan.TR/Dropper.Gen
DrWebTrojan.DownLoad3.28161
ZillyaDownloader.Small.Win32.149892
TrendMicroTROJ_UPATRE.SMAS
McAfee-GW-EditionBehavesLike.Win32.Downloader.lz
Trapminemalicious.high.ml.score
SophosTroj/Upatre-YW
SentinelOneStatic AI – Suspicious PE
GDataWin32.Trojan.PSE.10GNMYL
JiangminTrojanDownloader.Generic.akuo
AviraTR/Dropper.Gen
XcitiumTrojWare.Win32.TrojanDownloader.Upatre.ACC@56yhj8
ArcabitTrojan.Ppatre.Gen.1
ZoneAlarmHEUR:Trojan-Downloader.Win32.Upatre.gen
MicrosoftTrojan:Win32/Upatre.MH!MTB
GoogleDetected
AhnLab-V3Trojan/Win32.Zbot.R83549
McAfeeDownloader-FBWV!3E1BD4042A88
MAXmalware (ai score=85)
VBA32BScope.Trojan.Downloader
MalwarebytesTrojan.Upatre.Generic
TrendMicro-HouseCallTROJ_UPATRE.SMAS
RisingDownloader.Agent!1.E264 (CLASSIC)
YandexTrojan.Agent!bKYKQvZLomQ
MaxSecureTrojan.Upatre.Gen
FortinetW32/Tiny.NIV!tr
Cybereasonmalicious.42a888
PandaTrj/Genetic.gen

How to remove Troj/Upatre-YW?

Troj/Upatre-YW removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment