Categories: Trojan

TrojanDownloader:Win32/Upatre.AL information

The TrojanDownloader:Win32/Upatre.AL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:Win32/Upatre.AL virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
A process attempted to delay the analysis task.
Dynamic (imported) function loading detected
Performs HTTP requests potentially not found in PCAP.
Reads data out of its own binary image
Drops a binary and executes it
Unconventionial language used in binary resources: Norwegian (Bokmal)
Authenticode signature is invalid
Deletes its original binary from disk
Attempts to modify proxy settings

How to determine TrojanDownloader:Win32/Upatre.AL?


File Info:
name: 0982841C09DEDA2F3830.mlwpath: /opt/CAPEv2/storage/binaries/102cddbe4cb8a8b163c9fc386d10e10853f7c457d472959472c6af2de6a0c7e9crc32: BDFB904Cmd5: 0982841c09deda2f3830d39d33dedd56sha1: 79e356333669d2bd4816de8fe380cf7ba79d7205sha256: 102cddbe4cb8a8b163c9fc386d10e10853f7c457d472959472c6af2de6a0c7e9sha512: 921123c30b09f51baa49309c6c4435a3c7b878c8ee95977a1966ef31390371aa3271e73257b1b5242a61f788c2eebd63ea3581103ffadda21542f3d51272354assdeep: 384:cOgYCEKnsh6Tk2ltxUpxifDpkFJ75Jdok5o2b88vn7f/oe9:qF0kfVcokNb88vnD/otype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1E9A24E097497EB8DE56322B0C836DA014E25729ABA2956CF1C9236067DD33B3913FD1Dsha3_384: 06bcf5b04dc5dc49a5445f81d0fdaca182d907a0c97e5ebe87da6154faa9cdd3f4f85350253ff9a66969f441322895bbep_bytes: b8eeff00008d0db033400051e8a5f8fftimestamp: 2008-06-28 20:44:53
Version Info:
CompanyName: LavatochFileDescription: Lavatoch Inc.FileVersion: Version 1.0.0.4InternalName: LavatochLegalCopyright: Copyright by Lavatoch Inc.OriginalFilename: LavatochTranslation: 0x0414 0x04b0

TrojanDownloader:Win32/Upatre.AL also known as:

Lionic	Trojan.Win32.Generic.lZ5Q
Elastic	malicious (high confidence)
DrWeb	Trojan.Upatre.100
MicroWorld-eScan	Trojan.GenericKD.1950285
FireEye	Generic.mg.0982841c09deda2f
CAT-QuickHeal	TrojanDwnldr.Upatre.AA3
McAfee	Upatre-FAAD
Cylance	Unsafe
Sangfor	Trojan.Win32.Staser.apol
K7AntiVirus	Trojan ( 0001140e1 )
Alibaba	TrojanDownloader:Win32/Staser.ea47c465
K7GW	Trojan-Downloader ( 0048f6391 )
Cybereason	malicious.c09ded
BitDefenderTheta	Gen:NN.ZexaF.34606.bm0@aeIbHIiG
VirIT	Trojan.Win32.Generic.DZD
Cyren	W32/Downloader.DTGT-0935
Symantec	Downloader.Upatre!gen5
ESET-NOD32	Win32/TrojanDownloader.Waski.A
TrendMicro-HouseCall	TROJ_UPATRE.YYQL
Paloalto	generic.ml
Kaspersky	Trojan.Win32.Staser.apol
BitDefender	Trojan.GenericKD.1950285
NANO-Antivirus	Trojan.Win32.Upatre.efhacp
SUPERAntiSpyware	Trojan.Agent/Gen-Upatre
Avast	Win32:Downloader-WIH [Trj]
Tencent	Malware.Win32.Gencirc.114bf634
Ad-Aware	Trojan.GenericKD.1950285
Emsisoft	Trojan.GenericKD.1950285 (B)
Comodo	TrojWare.Win32.TrojanDownloader.Waski.EB@5j320p
Baidu	Win32.Trojan-Downloader.Waski.a
Zillya	Downloader.Waski.Win32.2456
TrendMicro	TROJ_UPATRE.YYQL
McAfee-GW-Edition	BehavesLike.Win32.Trickbot.mm
Sophos	Mal/Generic-R + Troj/Upatre-GR
SentinelOne	Static AI – Malicious PE
GData	Win32.Trojan.Agent.3WZGYJ
Jiangmin	Trojan/Staser.aoh
Webroot	Trojan.Dropper.Gen
Avira	TR/Kryptik.coty
MAX	malware (ai score=100)
Kingsoft	Win32.Troj.Staser.ap.(kcloud)
Microsoft	TrojanDownloader:Win32/Upatre.AL
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Kryptik.R122906
VBA32	Trojan.Staser
ALYac	Trojan.GenericKD.1950285
Malwarebytes	Trojan.Upatre
APEX	Malicious
Rising	Trojan.DL.Win32.Upatre.arv (CLASSIC)
Yandex	Trojan.Staser!aWeigLpRpto
Ikarus	Trojan-Downloader.Waski
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Waski.A!tr
AVG	Win32:Downloader-WIH [Trj]
Panda	Trj/WLT.B
CrowdStrike	win/malicious_confidence_60% (W)