Trojan

Trojan-Downloader.Win32.Upatre.ihdk malicious file

Malware Removal

The Trojan-Downloader.Win32.Upatre.ihdk is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan-Downloader.Win32.Upatre.ihdk virus can do?

  • Executable code extraction
  • Creates RWX memory
  • A process created a hidden window
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • Deletes its original binary from disk
  • Network activity contains more than one unique useragent.
  • Attempts to modify proxy settings
  • Anomalous binary characteristics
  • Uses suspicious command line tools or Windows utilities

Related domains:

gg-clean.hk

How to determine Trojan-Downloader.Win32.Upatre.ihdk?


File Info:

crc32: 76CF427C
md5: 80f13e524fa895a7e5b39209ec2a02e2
name: kiskis.exe
sha1: 6c7acff1bbc09d5d6ec4f02bfcf493762c1bff05
sha256: 09e645be72729bbbfc0b8ae4f410df22a28b5f325c0f5726778c038863b2123d
sha512: 92fdd15a0f03109a4fb441dab840b004af3f510940dd15a0150fd986de92c97d2a4159e476feced298611c76724738d2eeca28da6b2d94156b76354367fbe091
ssdeep: 6144:UY69tJGA1FbwbSpQzvyqz++KCDmHZU6NYzykuwovCe:+lHkSpQOEv0PKykLoae
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

Translation: 0x0219 0x04e4

Trojan-Downloader.Win32.Upatre.ihdk also known as:

FireEyeGeneric.mg.80f13e524fa895a7
McAfeeArtemis!80F13E524FA8
CylanceUnsafe
SangforMalware
K7AntiVirusTrojan ( 003c36381 )
K7GWTrojan ( 003c36381 )
Cybereasonmalicious.1bbc09
BitDefenderThetaGen:NN.ZexaF.32515.uu0@a0CL0tc
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.GYXX
ClamAVWin.Packed.Tofsee-7413745-0
KasperskyTrojan-Downloader.Win32.Upatre.ihdk
APEXMalicious
RisingTrojan.Wacatac!8.10C01 (TFE:5:EcEeBvEz89H)
F-SecureTrojan.TR/AD.Chapak.domz
Invinceaheuristic
McAfee-GW-EditionBehavesLike.Win32.MultiPlug.fc
Trapminemalicious.high.ml.score
SentinelOneDFI – Malicious PE
AviraTR/AD.Chapak.domz
Endgamemalicious (high confidence)
AhnLab-V3Trojan/Win32.MalPe.R301592
ZoneAlarmTrojan-Downloader.Win32.Upatre.ihdk
MicrosoftTrojan:Win32/Wacatac.B!ml
Acronissuspicious
VBA32Malware-Cryptor.Limpopo
MalwarebytesTrojan.MalPack.GS
AVGFileRepMalware
CrowdStrikewin/malicious_confidence_100% (D)
Qihoo-360HEUR/QVM10.1.8DD8.Malware.Gen

How to remove Trojan-Downloader.Win32.Upatre.ihdk?

Trojan-Downloader.Win32.Upatre.ihdk removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment