Malware

Troj/Upatre-YW malicious file

Malware Removal

The Troj/Upatre-YW is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Troj/Upatre-YW virus can do?

  • Sample contains Overlay data
  • Performs HTTP requests potentially not found in PCAP.
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Authenticode signature is invalid
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Attempts to modify proxy settings

How to determine Troj/Upatre-YW?


File Info:

name: 2806F131A6588EDA7A7D.mlw
path: /opt/CAPEv2/storage/binaries/3b98dc4bac7f73c2f6bd28f0b0c74d1e77a0c703157f2684c9138cc58df3dd4e
crc32: 46F5A965
md5: 2806f131a6588eda7a7d509418ec4df7
sha1: a32eec56e259af2d8495ba8e7aa1669b23282f09
sha256: 3b98dc4bac7f73c2f6bd28f0b0c74d1e77a0c703157f2684c9138cc58df3dd4e
sha512: 30465e7e1f8bf1c9fbe5e36bb758a53ed5a1688ae12f746253d25d15f28574d9e480feedeec257aaf079aa74b50aa022525024424beb67bf4fe144f91bd59f5b
ssdeep: 192:3SjtoITgr0fkMnPkT/1YgOmGAGHp8Iavz:aoITgrrYXBJzm
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13D124A343BD56A72E3BBCFB586F551C5BA35B0627D16D90D40AA43840823FA6DCB1A0F
sha3_384: d0ff153b1552abe64d7152d242303f857a64df604cf267e6e949b83199e6f07d6e92460a018ad0134826c55e2d31f1cd
ep_bytes: 558becb83c200000e863030000535657
timestamp: 2013-09-06 09:44:54

Version Info:

0: [No Data]

Troj/Upatre-YW also known as:

LionicTrojan.Win32.Upatre.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.Ppatre.Gen.1
FireEyeGeneric.mg.2806f131a6588eda
McAfeeDownloader-FBWV!2806F131A658
Cylanceunsafe
VIPRETrojan.Ppatre.Gen.1
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan-Downloader ( 0050fef41 )
AlibabaMalware:Win32/km_28d8f.None
K7GWTrojan-Downloader ( 0050fef41 )
CrowdStrikewin/malicious_confidence_100% (W)
BitDefenderThetaGen:NN.ZexaE.36308.amX@ayjVPSi
VirITTrojan.Win32.Upatre.AJ
CyrenW32/Upatre.LX.gen!Eldorado
SymantecML.Attribute.HighConfidence
tehtrisGeneric.Malware
ESET-NOD32a variant of Win32/TrojanDownloader.Small.PRL
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Downloader.Upatre-9952018-0
KasperskyHEUR:Trojan-Downloader.Win32.Upatre.gen
BitDefenderTrojan.Ppatre.Gen.1
NANO-AntivirusTrojan.Win32.DownLoad3.dofdyx
AvastWin32:Downloader-WID [Trj]
TencentTrojan-DL.Win32.Small.yw
DrWebTrojan.DownLoad3.28161
ZillyaDownloader.Small.Win32.149892
TrendMicroTROJ_UPATRE.SM37
Trapminemalicious.high.ml.score
SophosTroj/Upatre-YW
IkarusTrojan-Downloader.Win32.Upatre
GDataWin32.Trojan-Downloader.Upatre.BJ
JiangminTrojanDownloader.Generic.akuo
AviraTR/ATRAPS.Gen
MAXmalware (ai score=80)
Antiy-AVLTrojan/Win32.Waski.a
XcitiumTrojWare.Win32.TrojanDownloader.Upatre.ACC@56yhj8
ArcabitTrojan.Ppatre.Gen.1
ViRobotTrojan.Win32.Z.Upatre.9582.AW
MicrosoftTrojan:Win32/Upatre.MH!MTB
GoogleDetected
AhnLab-V3Trojan/Win32.Zbot.R83549
VBA32BScope.Trojan.Downloader
ALYacTrojan.Ppatre.Gen.1
TACHYONTrojan-Downloader/W32.Upatre.9582.B
TrendMicro-HouseCallTROJ_UPATRE.SM37
RisingDownloader.Agent!1.E264 (CLASSIC)
YandexTrojan.Agent!/vT5Vnlxh3c
SentinelOneStatic AI – Suspicious PE
MaxSecureTrojan.Upatre.Gen
FortinetW32/Tiny.NIV!tr
AVGWin32:Downloader-WID [Trj]
Cybereasonmalicious.1a6588
PandaTrj/Genetic.gen

How to remove Troj/Upatre-YW?

Troj/Upatre-YW removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment