Trojan

How to remove “TrojanDownloader:Win32/Upatre!pz”?

Malware Removal

The TrojanDownloader:Win32/Upatre!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What TrojanDownloader:Win32/Upatre!pz virus can do?

  • Sample contains Overlay data
  • Performs HTTP requests potentially not found in PCAP.
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Authenticode signature is invalid
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Attempts to modify proxy settings

How to determine TrojanDownloader:Win32/Upatre!pz?


File Info:

name: 19AFEDA5DB049F45764E.mlw
path: /opt/CAPEv2/storage/binaries/f17d98f8fa4828da716f0387847ae68877cf758f93643b150047bb41f699d2e9
crc32: BCCC9A7E
md5: 19afeda5db049f45764eeb556f6d6593
sha1: a5450e327b22afa2de6fa4ab1eab452a24a5e28b
sha256: f17d98f8fa4828da716f0387847ae68877cf758f93643b150047bb41f699d2e9
sha512: 56c49ac991e95cb553e144e63ae7410a6832f0b15bb6985364397d3eac046db25700cc83d82a513c7edc12edccb9135d389ab264634fa25c904c7639365a7c6a
ssdeep: 192:sHO6OI9TsYev1mjTfg5YG5H7pLWCW/vYxYhyfKdrwP6ka:vI9TawPgWG5b+YHywCka
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FF6215386FD61AB6E377DAF385F296C6A975F132B513CA0D80DA0B440913A52AC90D1E
sha3_384: 833849f9d0204f128c2030e8eb9244f2c954adec85befd1358b957340a36f7af1c337bcb3aac8d5353db715f7afdb30d
ep_bytes: 558becb83c200000e893030000535657
timestamp: 2013-09-11 14:39:41

Version Info:

0: [No Data]

TrojanDownloader:Win32/Upatre!pz also known as:

BkavW32.AIDetectMalware
LionicTrojan.Win32.Upatre.1j!c
tehtrisGeneric.Malware
MicroWorld-eScanTrojan.GenericKD.71194611
ClamAVWin.Malware.Upatre-6722905-0
FireEyeGeneric.mg.19afeda5db049f45
CAT-QuickHealTrojan.Mauvaise.SL1
SkyhighBehavesLike.Win32.Upatre.lz
ALYacTrojan.GenericKD.71194611
Cylanceunsafe
ZillyaDownloader.Small.Win32.71821
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan-Downloader ( 0050fef41 )
AlibabaTrojan:Win32/Upatre.110cc
K7GWTrojan-Downloader ( 00456a071 )
CrowdStrikewin/malicious_confidence_100% (W)
BitDefenderThetaGen:NN.ZexaE.36744.amY@aGKDNwf
VirITTrojan.Win32.Generic.BSZC
SymantecDownloader.Upatre!gm
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/TrojanDownloader.Small.PRL
APEXMalicious
CynetMalicious (score: 100)
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderTrojan.GenericKD.71194611
NANO-AntivirusTrojan.Win32.DownLoad3.cqsjfu
SUPERAntiSpywareTrojan.Agent/Gen-Upatre
AvastWin32:Downloader-WID [Trj]
TencentTrojan.Win32.Downloader.wf
EmsisoftTrojan.GenericKD.71194611 (B)
BaiduWin32.Trojan-Downloader.Waski.k
F-SecureTrojan.TR/Dropper.Gen
DrWebTrojan.DownLoader26.64201
VIPRETrojan.GenericKD.71194611
TrendMicroTROJ_UPATRE.SMAS
Trapminemalicious.high.ml.score
SophosTroj/Upatre-XZ
SentinelOneStatic AI – Malicious PE
GDataWin32.Trojan.PSE.12DMSKF
JiangminTrojanDownloader.Genome.acpr
WebrootW32.Malware.Gen
GoogleDetected
AviraTR/Dropper.Gen
Antiy-AVLTrojan/Win32.Waski.a
KingsoftWin32.Trojan.Generic.a
XcitiumTrojWare.Win32.TrojanDownloader.Upatre.ACC@56yhj8
ArcabitTrojan.Generic.D43E57F3
ZoneAlarmHEUR:Trojan.Win32.Generic
MicrosoftTrojanDownloader:Win32/Upatre!pz
VaristW32/Trojan3.AQGI
AhnLab-V3Trojan/Win32.Zbot.R83549
Acronissuspicious
McAfeeDownloader-FBWV!19AFEDA5DB04
MAXmalware (ai score=80)
VBA32Trojan.Downloader
MalwarebytesGeneric.Malware.AI.DDS
PandaTrj/Genetic.gen
TrendMicro-HouseCallTROJ_UPATRE.SMAS
RisingDownloader.Waski!1.A489 (CLASSIC)
YandexTrojan.GenAsa!LXiB97J6ZtU
IkarusTrojan-Downloader.Win32.Upatre
MaxSecureTrojan.Upatre.Gen
FortinetW32/Tiny.NIV!tr
AVGWin32:Downloader-WID [Trj]
Cybereasonmalicious.27b22a
DeepInstinctMALICIOUS

How to remove TrojanDownloader:Win32/Upatre!pz?

TrojanDownloader:Win32/Upatre!pz removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment