Trojan

Trojan:Win32/Upatre!pz (file analysis)

Malware Removal

The Trojan:Win32/Upatre!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan:Win32/Upatre!pz virus can do?

  • Sample contains Overlay data
  • Performs HTTP requests potentially not found in PCAP.
  • Reads data out of its own binary image
  • Authenticode signature is invalid
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Attempts to modify proxy settings

How to determine Trojan:Win32/Upatre!pz?


File Info:

name: D61CB472A9424BC03F79.mlw
path: /opt/CAPEv2/storage/binaries/2a1c4117da22e74e3e9c1502a180fde78359b08e0c3165e0d0a739bf894b38fc
crc32: 341ABE33
md5: d61cb472a9424bc03f790d349fe0efad
sha1: 4b88bbc600a0292767b4c71ca0a5318420a5d537
sha256: 2a1c4117da22e74e3e9c1502a180fde78359b08e0c3165e0d0a739bf894b38fc
sha512: 1ce404ab12c9c9199dc497d04cba3a539cbd06c8d438c154eee599c94bd39fb67d779d75bc2f7f7c7efa2aae514b3598af8e68aff0c8d99b93811d289be0effa
ssdeep: 384:FFnwR2IT1XKqC9YATzWLkAzFAll6EPDLO7n5bJFvfyK:LwRrT16WFFAv6EPDSdbryK
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F5D2B03C5EE91672E3BBCAB6C5F655C7B974B4223912D80D40CB43850823F66EDE1A1E
sha3_384: 03bff27f362b2f204871fe28fc91685594f188a613bc6087d58dbafc5fd6e76b76ba4a6534d0d2fb0e1dc9af76b18ed4
ep_bytes: 558bec81ec3c08000053565733f656ff
timestamp: 2013-10-09 18:19:12

Version Info:

0: [No Data]

Trojan:Win32/Upatre!pz also known as:

BkavW32.AIDetectMalware
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKDZ.74346
ClamAVWin.Downloader.Upatre-7598844-0
CAT-QuickHealTrojan.Mauvaise.SL1
SkyhighBehavesLike.Win32.Generic.mz
McAfeeDownloader-FBVZ!D61CB472A942
MalwarebytesGeneric.Malware.AI.DDS
VIPRETrojan.GenericKDZ.74346
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (D)
K7GWTrojan-Downloader ( 004b972f1 )
K7AntiVirusTrojan-Downloader ( 0055f33b1 )
BaiduWin32.Trojan-Downloader.Waski.k
SymantecDownloader.Upatre!gm
tehtrisGeneric.Malware
ESET-NOD32a variant of Win32/TrojanDownloader.Waski.A
APEXMalicious
CynetMalicious (score: 100)
KasperskyHEUR:Trojan.Win32.Bublik.pef
BitDefenderTrojan.GenericKDZ.74346
NANO-AntivirusTrojan.Win32.DownLoad3.cnbuup
SUPERAntiSpywareTrojan.Agent/Gen-Downloader
AvastWin32:Downloader-WID [Trj]
TencentTrojan.Win32.Downloader.wb
SophosTroj/Upatre-YW
F-SecureTrojan.TR/Dropper.Gen
DrWebTrojan.DownLoad3.28161
ZillyaDownloader.Waski.Win32.13050
TrendMicroTROJ_UPATRE.SMAZ
FireEyeGeneric.mg.d61cb472a9424bc0
EmsisoftTrojan.GenericKDZ.74346 (B)
SentinelOneStatic AI – Malicious PE
GDataWin32.Trojan-Downloader.Upatre.BJ
JiangminTrojan/Generic.azrzv
WebrootW32.Trojan.Gen
GoogleDetected
AviraTR/Dropper.Gen
MAXmalware (ai score=86)
Antiy-AVLTrojan[Downloader]/Win32.Upatre
Kingsoftmalware.kb.a.999
XcitiumTrojWare.Win32.TrojanDownloader.Small.CDC@8mzsfr
ArcabitTrojan.Generic.D1226A
ZoneAlarmHEUR:Trojan.Win32.Bublik.pef
MicrosoftTrojan:Win32/Upatre!pz
VaristW32/S-5aba6b96!Eldorado
AhnLab-V3Trojan/Win32.Dloader.R87521
Acronissuspicious
BitDefenderThetaGen:NN.ZexaF.36744.bqY@aSzRtMd
ALYacTrojan.GenericKDZ.74346
VBA32Trojan.Download
Cylanceunsafe
PandaTrj/Genetic.gen
TrendMicro-HouseCallTROJ_UPATRE.SMAZ
RisingDownloader.Agent!1.C06E (CLASSIC)
YandexTrojan.GenAsa!xjw/xZS1BKE
IkarusTrojan-Downloader.Win32.Upatre
MaxSecureTrojan.Upatre.Gen
FortinetW32/Waski.A!tr
AVGWin32:Downloader-WID [Trj]
DeepInstinctMALICIOUS

How to remove Trojan:Win32/Upatre!pz?

Trojan:Win32/Upatre!pz removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment