Home / malware TrojanDownloader:Win32/Upatre.AI
First posted on 20 October 2014.
Source: MicrosoftAliases :
There are no other names known for TrojanDownloader:Win32/Upatre.AI.
Explanation :
Threat behavior
Installation
TrojanDownloader:Win32/Upatre.AI creates the following files on your PC:
- c:\documents and settings\administrator\local settings\temp\trdiv.exe
Payload
Contacts remote hosts
TrojanDownloader:Win32/Upatre.AI can contact the following remote hosts:
- 94.75.233.13 using port 25401
- fitnessxtreme.co.uk using port 80
- thegulfitjobs.com using port 80
Commonly, malware contacts a remote host to:This malware description was produced and published using automated analysis of file SHA1 99e2385b466ccc40fbbda6dc64d1d57134581529.Symptoms
- Confirm Internet connectivity
- Report a new infection to its author
- Receive configuration or other data
- Download and run files (including updates and other malware)
- Receive instruction from a remote hacker
- Upload information taken from your PC
System changes
The following could indicate that you have this threat on your PC:
- You have these files:
c:\documents and settings\administrator\local settings\temp\trdiv.exeLast update 20 October 2014