Malware

Troj/Upatre-YW removal tips

Malware Removal

The Troj/Upatre-YW is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Troj/Upatre-YW virus can do?

  • Sample contains Overlay data
  • Performs HTTP requests potentially not found in PCAP.
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Authenticode signature is invalid
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Attempts to modify proxy settings

How to determine Troj/Upatre-YW?


File Info:

name: 9E52F7B55181A02CDA44.mlw
path: /opt/CAPEv2/storage/binaries/006e8d3de4ad5f3d125c522e750414eb03bd473a77e1359eaac19fd772c8a521
crc32: DB220CFD
md5: 9e52f7b55181a02cda44d54f3d266dc8
sha1: e8962e57b85c25823519bf03e51c0b5fb0556ac2
sha256: 006e8d3de4ad5f3d125c522e750414eb03bd473a77e1359eaac19fd772c8a521
sha512: ec487dbda5d9dd1c8d668ed6d15bd355de6c18571730bf7140a9893bb260b57ea777910c10b6f759f5f40fc62b113565ac38d11e51f24089c7971e1492dec018
ssdeep: 96:rlRc6dTc3UZ0it64aVSTmtID7hk5ZJ+fFdTZ8DWYIFlc90OQEPYQH2+X0OlYq+rt:3SE9toITXCJ8F2Tw9npOkPn3QccTsehW
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T109124A382BE55A72E37BCFB5C6F542C6B975B1623D06D80D40EA43480423FA6DDB1A0E
sha3_384: bcf7a1d01d8d0a56dff5c13974ea7d645e1168c044b29a02813115bc2b19bad8cf7638daf6f00cef8a325bb5cf072299
ep_bytes: 558becb83c200000e863030000535657
timestamp: 2013-09-06 09:44:54

Version Info:

0: [No Data]

Troj/Upatre-YW also known as:

BkavW32.AIDetectNet.01
LionicTrojan.Win32.Upatre.4!c
tehtrisGeneric.Malware
MicroWorld-eScanTrojan.Ppatre.Gen.1
ClamAVWin.Downloader.Upatre-9952018-0
FireEyeGeneric.mg.9e52f7b55181a02c
ALYacTrojan.Ppatre.Gen.1
Cylanceunsafe
ZillyaDownloader.Small.Win32.149892
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan-Downloader ( 0050fef41 )
AlibabaMalware:Win32/km_28d8f.None
K7GWTrojan-Downloader ( 0050fef41 )
Cybereasonmalicious.55181a
ArcabitTrojan.Ppatre.Gen.1
VirITTrojan.Win32.Upatre.AJ
CyrenW32/Upatre.LX.gen!Eldorado
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/TrojanDownloader.Small.PRL
APEXMalicious
Paloaltogeneric.ml
CynetMalicious (score: 100)
KasperskyHEUR:Trojan-Downloader.Win32.Upatre.gen
BitDefenderTrojan.Ppatre.Gen.1
NANO-AntivirusTrojan.Win32.DownLoad3.dofdyx
AvastWin32:Downloader-WID [Trj]
TencentTrojan-DL.Win32.Small.yw
EmsisoftTrojan.Ppatre.Gen.1 (B)
F-SecureTrojan.TR/ATRAPS.Gen
DrWebTrojan.DownLoad3.28161
VIPRETrojan.Ppatre.Gen.1
TrendMicroTROJ_UPATRE.SM37
McAfee-GW-EditionBehavesLike.Win32.Downloader.zz
Trapminemalicious.high.ml.score
SophosTroj/Upatre-YW
IkarusTrojan-Downloader.Win32.Upatre
JiangminTrojanDownloader.Generic.akuo
AviraTR/ATRAPS.Gen
MAXmalware (ai score=87)
Antiy-AVLTrojan/Win32.Waski.a
XcitiumTrojWare.Win32.TrojanDownloader.Upatre.ACC@56yhj8
MicrosoftTrojan:Win32/Upatre.MH!MTB
ZoneAlarmHEUR:Trojan-Downloader.Win32.Upatre.gen
GDataWin32.Trojan.PSE.10GNMYL
GoogleDetected
AhnLab-V3Trojan/Win32.Zbot.R83549
McAfeeDownloader-FBWV!9E52F7B55181
TACHYONTrojan-Downloader/W32.Upatre.9870
VBA32BScope.Trojan.Downloader
TrendMicro-HouseCallTROJ_UPATRE.SM37
RisingDownloader.Agent!1.E264 (CLASSIC)
YandexTrojan.GenAsa!xjw/xZS1BKE
SentinelOneStatic AI – Suspicious PE
MaxSecureTrojan.Upatre.Gen
FortinetW32/Tiny.NIV!tr
BitDefenderThetaGen:NN.ZexaE.36308.amX@ayjVPSi
AVGWin32:Downloader-WID [Trj]
PandaTrj/Genetic.gen
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Troj/Upatre-YW?

Troj/Upatre-YW removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment