Trojan.UpatreRI.S26141426 (file analysis)

The Trojan.UpatreRI.S26141426 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.UpatreRI.S26141426 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Divehi
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Deletes its original binary from disk
• Network activity contains more than one unique useragent.
• CAPE detected the OnlyLogger malware family
• Attempts to modify proxy settings
• Uses suspicious command line tools or Windows utilities

How to determine Trojan.UpatreRI.S26141426?

File Info:
name: 08CE366E35E4E0441950.mlw
path: /opt/CAPEv2/storage/binaries/348ab54ce50b8b060f3b9034df308e74101d903fead0c7d7e958cefe4e08272d
crc32: 7315A528
md5: 08ce366e35e4e04419508d685d3d0d68
sha1: bb395acd5e86de8f87291efe4a3b0f3fb15cc452
sha256: 348ab54ce50b8b060f3b9034df308e74101d903fead0c7d7e958cefe4e08272d
sha512: fd559bb42b8624a44235a460a057ea9b7b801edc406afc29fec7002078669bd179d58efc40cf7369290e13c5fb9eae8d4acf9b78a9eb9dd0c6ebcd940d6588ba
ssdeep: 6144:QUQ6zuEfwIHvgnic6txfY8U0hmZK5k/jB1yKlxHONqhnpcJD/5:QUFwIaicM3JmZK5k/jB6N04
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10074AF10BBA0D035F9F712F8467A936CA93E3AB1572491CB53D416EE96396E0EC32317
sha3_384: 74ef3626fa23999532b2dfbde1a7278943ce149a2cc0020134a578c5d74314bb8e5769c0e9b16c436ecabfe25a870f12
ep_bytes: 8bff558bece8e6b30000e8110000005d
timestamp: 2021-01-12 11:30:22

Version Info:
0: [No Data]

Trojan.UpatreRI.S26141426 also known as:

How to remove Trojan.UpatreRI.S26141426?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.