Categories: Trojan

About “Trojan-Downloader.Win32.Upatre.iyzc” infection

The Trojan-Downloader.Win32.Upatre.iyzc is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan-Downloader.Win32.Upatre.iyzc virus can do?

  • Sample contains Overlay data
  • Presents an Authenticode digital signature
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • Authenticode signature is invalid
  • Attempts to modify proxy settings
  • Anomalous binary characteristics

How to determine Trojan-Downloader.Win32.Upatre.iyzc?


File Info:

name: 2B749A7C29483F0F8358.mlwpath: /opt/CAPEv2/storage/binaries/89e99cc9200fe9f599d7dea500044db1c735fa69c0dd7df0edde9f88c50119e3crc32: 123399F8md5: 2b749a7c29483f0f8358bded0810b3f5sha1: c7f933de8696f02001bb634cd6f81b1838615fccsha256: 89e99cc9200fe9f599d7dea500044db1c735fa69c0dd7df0edde9f88c50119e3sha512: 59ae844720038e5638e42e16a0ea7ee306bbf922a0ea2f5f411790567269863667412e1bce56165204ee4a7a6169d17f2f2bdab5171b2605e0b12c79f3928f6bssdeep: 6144:4pK37S27OZ4wYMEWirl72kT5UCvlqylFhZboiI+Yb:R37F44wjm2O3vlpvkBbtype: PE32+ executable (GUI) x86-64, for MS Windowstlsh: T1EB847C46F76458F6D567C139CA83978AE7B27C654B20938F02A08B6A3F337A15D3D312sha3_384: b7e76b4ad593bc5942072e21d3845b6cc03fab0982ad1bb137a0f529af6147f8fcba2ade90f860bd378a9a5576e975c0ep_bytes: 41555756534881ec48010000488d0d29timestamp: 2017-10-09 05:24:32

Version Info:

CompanyName: 360.cnFileDescription: 360安全卫士 系统修复图标扫描模块FileVersion: 1, 0, 0, 1037InternalName: 360DeskAna.exeLegalCopyright: (C) 360.cn Inc. All Rights Reserved.OriginalFilename: 360DeskAna.exeProductName: 360安全卫士ProductVersion: 1, 0, 0, 1037Translation: 0x0804 0x04b0

Trojan-Downloader.Win32.Upatre.iyzc also known as:

Lionic Trojan.Win32.Upatre.a!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.37225553
FireEye Trojan.GenericKD.37225553
ALYac Trojan.GenericKD.37225553
Malwarebytes Generic.Malware/Suspicious
K7AntiVirus Trojan-Downloader ( 0057f53d1 )
Alibaba TrojanDownloader:Win32/Upatre.708f08df
K7GW Trojan-Downloader ( 0057f53d1 )
Cybereason malicious.e8696f
Symantec Trojan.Gen.MBT
ESET-NOD32 a variant of Win64/TrojanDownloader.Agent.LA
Cynet Malicious (score: 99)
Kaspersky Trojan-Downloader.Win32.Upatre.iyzc
BitDefender Trojan.GenericKD.37225553
Avast Win64:Trojan-gen
Tencent Win32.Trojan-Downloader.Upatre.Najl
Sophos Mal/Generic-S
F-Secure Trojan.TR/Dldr.Agent.ljdmx
VIPRE Trojan.GenericKD.37225553
TrendMicro TROJ_GEN.R002C0WDM23
McAfee-GW-Edition Artemis
Emsisoft Trojan.GenericKD.37225553 (B)
Ikarus Trojan-Downloader.Win64.Agent
GData Trojan.GenericKD.37225553
Avira TR/Dldr.Agent.ljdmx
Arcabit Trojan.Generic.D2380451
ZoneAlarm Trojan-Downloader.Win32.Upatre.iyzc
Microsoft Trojan:Win32/Wacatac.B!ml
Google Detected
McAfee Artemis!2B749A7C2948
MAX malware (ai score=89)
VBA32 TrojanDownloader.Upatre
Cylance unsafe
Panda Trj/CI.A
TrendMicro-HouseCall TROJ_GEN.R002C0WDM23
Rising Downloader.Agent!8.B23 (CLOUD)
MaxSecure Trojan.Malware.119747478.susgen
Fortinet PossibleThreat.MU
AVG Win64:Trojan-gen
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)

How to remove Trojan-Downloader.Win32.Upatre.iyzc?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Recent Posts

Win32.Worm.Viking.NCO removal guide

The Win32.Worm.Viking.NCO is considered dangerous by lots of security experts. When this infection is active,…

5 mins ago

Symmi.3957 removal

The Symmi.3957 is considered dangerous by lots of security experts. When this infection is active,…

10 mins ago

Generic.Dacic.304514EE.A.8008A8E4 removal tips

The Generic.Dacic.304514EE.A.8008A8E4 is considered dangerous by lots of security experts. When this infection is active,…

10 mins ago

Zusy.545161 removal instruction

The Zusy.545161 is considered dangerous by lots of security experts. When this infection is active,…

10 mins ago

Generic.Dacic.6D934B1C.A.D7790222 malicious file

The Generic.Dacic.6D934B1C.A.D7790222 is considered dangerous by lots of security experts. When this infection is active,…

16 mins ago

How to remove “Fragtor.513062”?

The Fragtor.513062 is considered dangerous by lots of security experts. When this infection is active,…

16 mins ago