Trojan:Win32/Upatre!pz (file analysis)

The Trojan:Win32/Upatre!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Upatre!pz virus can do?

• Sample contains Overlay data
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• Drops a binary and executes it
• Authenticode signature is invalid
• Attempts to repeatedly call a single API many times in order to delay analysis time
• Attempts to modify proxy settings
• Anomalous binary characteristics

How to determine Trojan:Win32/Upatre!pz?

File Info:
name: DF574F977367097C54CA.mlw
path: /opt/CAPEv2/storage/binaries/9a9c36fb1c73cae3099e2c6fafbf80626882dd066db0a2893b94ae00ddb66bc0
crc32: 6D2F5A34
md5: df574f977367097c54cafe0c459b05c0
sha1: 1b4df5deac84b5d634a5ac90149e9bf192e6a026
sha256: 9a9c36fb1c73cae3099e2c6fafbf80626882dd066db0a2893b94ae00ddb66bc0
sha512: 65a3789f0eb27526d2281f3b72fd2ab4a76177d7e10953110764635bcff8fc04c32f2f7e4cf3792b743c30eacdbf5deff745569c3c29e76d9c35454010da0b84
ssdeep: 768:dwowRmYl50PsED3VK2+ZtyOjgO4r9vFAg2rqfe4mvH8A3kSnjbZ6/cBtGi2Xj+S:dwl36YTjipvF234wRkSnj0/cqtj+S
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12F83CA387AD955B2E37BC67685F681D6B931BC227C51881F248B334D0C33F56ACA1A1E
sha3_384: f01bc01a38a8c154280cd1767cca0fe9d0140bfe72528f48bfce50fffcc8e6ce2b004fdb0b1608877f8d27959d22e57e
ep_bytes: 558bec81ec3808000053565733f656ff
timestamp: 2013-10-30 10:58:20

Version Info:
0: [No Data]

Trojan:Win32/Upatre!pz also known as:

How to remove Trojan:Win32/Upatre!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.