Trojan-Downloader.Win32.Upatre.ecgl information

The Trojan-Downloader.Win32.Upatre.ecgl is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Downloader.Win32.Upatre.ecgl virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Creates RWX memory
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• Unconventionial binary language: Polish
• Unconventionial language used in binary resources: Polish
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavior consistent with a dropper attempting to download the next stage.
• Attempts to modify proxy settings
• Mimics icon used for popular non-executable file format
• Anomalous binary characteristics

How to determine Trojan-Downloader.Win32.Upatre.ecgl?

File Info:
name: AF4F69AC96918BFD1D06.mlw
path: /opt/CAPEv2/storage/binaries/69fa436c1db477cd260a5bc1fcf89e22998a263cecec1383f10a1d0054ac95f0
crc32: 3A76B3FD
md5: af4f69ac96918bfd1d06e43167e9c03a
sha1: 78683afaebd6676bd47e10ae6604bd8c0e7deadf
sha256: 69fa436c1db477cd260a5bc1fcf89e22998a263cecec1383f10a1d0054ac95f0
sha512: 48869cd57325e42fefaa3fc7ad6fb1a8c0dd8e9a30893b4c89a53c1ef4a4361bffb6fd258fa581ee374fe2d8d41567bfca4190acf205bcf2b8c5d0f6ab6b65cc
ssdeep: 384:VM7fXf+x5b7OfcAhvxxsz/QMLf6d0sliMk8y4Mvh5LluvRbA2Ow4OapBtZbWizzY:Qex5f+hI5LChUFRp5LluvLOkuzK5
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E023C3A156C94291EAB24F3DC1B266C612A57E217EF1F81F8C9032C45F337D2B9F0A16
sha3_384: 9b980422cf666d9be07ea935a3bd902928596b006faee565fa9e58a6a049a6816c09297c99c3b26b12071e7820eec212
ep_bytes: 558bec83ec44a1647a400085c0740aff
timestamp: 2014-10-22 02:25:29

Version Info:
CompanyName: Winapp
FileDescription: Winapp
FileVersion: 1.1.2.17
InternalName: WinappInternal
LegalCopyright: 
LegalTrademarks: 
OriginalFilename: 
ProductName: Winapp
ProductVersion: 2.17
Translation: 0x0415 0x04e4

Trojan-Downloader.Win32.Upatre.ecgl also known as:

How to remove Trojan-Downloader.Win32.Upatre.ecgl?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.