What is “Trojan-Downloader.Win32.Upatre.ebmp”?

The Trojan-Downloader.Win32.Upatre.ebmp is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Downloader.Win32.Upatre.ebmp virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Creates RWX memory
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• Drops a binary and executes it
• Unconventionial binary language: Polish
• Unconventionial language used in binary resources: Polish
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavior consistent with a dropper attempting to download the next stage.
• Attempts to modify proxy settings
• Mimics icon used for popular non-executable file format
• Anomalous binary characteristics

How to determine Trojan-Downloader.Win32.Upatre.ebmp?

File Info:
name: 0B5326F055EAE86FCC84.mlw
path: /opt/CAPEv2/storage/binaries/aa5e1e7e98e30fb2e9b2232fa01fc3b72e9b0e6ea1ddae8e71eb5939bc449ed2
crc32: C1BC57BA
md5: 0b5326f055eae86fcc84a59ed832d526
sha1: 465646e201a23aebbf902cb9c3586324b432de98
sha256: aa5e1e7e98e30fb2e9b2232fa01fc3b72e9b0e6ea1ddae8e71eb5939bc449ed2
sha512: e1b6148c4771a60bbf30306162bfd02ed2f304b3599994a848a5fae6bb606c6d638613efe83de45a7bf6e738823d1f5ef6efc15fa586ea49bf2916b2108a3bd2
ssdeep: 384:JIqtnzDAxWZvT4bYbortyUPhQ2FdGjVw1x3ydFFE9f0UzXWqw+5yld/yLNaa/+Zl:J3toINUbaSdACkE90QRw+5ylFyJ/9uz7
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C013D47296C84265D6B21F3CD1B26AC612A6BE217EF1F80F9C8071C45F336D6B5F0A16
sha3_384: 5719b41c52699491213f316b22a5e97e1887ea9ad2fff02a3448036a8935c6aad378463f4b46cfb4397de064a53b3b40
ep_bytes: 558bec83ec44a1245a400085c0740aff
timestamp: 2015-02-15 11:27:13

Version Info:
CompanyName: Winapp
FileDescription: Winapp
FileVersion: 1.1.2.17
InternalName: WinappInternal
LegalCopyright: 
LegalTrademarks: 
OriginalFilename: 
ProductName: Winapp
ProductVersion: 2.17
Translation: 0x0415 0x04e4

Trojan-Downloader.Win32.Upatre.ebmp also known as:

How to remove Trojan-Downloader.Win32.Upatre.ebmp?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.