Home / malware

PDF

TrojanDownloader:Win32/Upatre.B

First posted on 23 January 2014.
Source: Microsoft

Aliases :

There are no other names known for TrojanDownloader:Win32/Upatre.B.

Explanation :

Threat behavior

Installation

TrojanDownloader:Win32/Upatre.B can be installed on your PC by the following malware:

• Trojan:Win32/Alureon.FO
• Trojan:Win32/Tesch.B

When run, TrojanDownloader:Win32/Upatre.B creates the following file:

• %ALLUSERSPROFILE% \Application Data\Mozilla\.exe, where .exe is hardcoded inside the malware file. For example, %ALLUSERSPROFILE%\Application Data\Mozilla\jbvusrj.exe.

It also creates a scheduled task that runs thie malware at each system start:

• %windir% \tasks\.job, where .job is hardcoded inside the malware file.

Payload

Downloads updates and other malware

TrojanDownloader:Win32/Upatre.B connects to a remote server to download updates and other malware. The server address is hardcoded in the malware.

We have seen it connect to the following servers:

• bluecreatureoftheseascom
• choose-musicnet
• dns-rabbitcom
• every-documentationcom
• further-configurationcom
• menaged-recognitioncom
• net-forwardingcom
• net-translsclcom
• news-online24com
• one-discoverycom
• other-salecom
• pi-forwardingcom
• quality-whoiscom
• the-auto-companycom
• shift-companycom
• yahyeu-domaincom

It then downloads an updated version of itself and other malware files, including variants of:

• PWS:Win32/Zbot
• TrojanDropper:Win32/Rovnix

The downloaded file is saved as %TEMP%\Java_Update_.exe, for example, %TEMP%\Java_Update_5a8bf3e9.exe



Analysis by Zarestel Ferrer

Symptoms

The following could indicate that you have this threat on your PC:

• You have these files:
  
  %ALLUSERSPROFILE%\Application Data\Mozilla\.exe, where .exe is hardcoded inside the malware file. For example, %ALLUSERSPROFILE%\Application Data\Mozilla\jbvusrj.exe
  
• You have this scheduled task:
  
  %windir%\tasks\.job

Last update 23 January 2014

 

TOP