TROJ_UPATRE.OYPA

June 06, 2015
 Analysis by: Sammy Chua
 ALIASES:

TrojanDownloader:Win32/Upatre.BI (Microsoft); Troj/Upatre-LD (Sophos); W32/Upatre.BB (F-Prot); Downloader.Upatre (Symantec)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

  TECHNICAL DETAILS

File Size:

50,176 bytes

File Type:

EXE

Memory Resident:

No

Initial Samples Received Date:

19 May 2015

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

  • %User Temp%\makedopar.exe

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other System Modifications

This Trojan adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DoNotAllowExceptions = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DisableNotifications = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SharedAccess\Parameters\
FirewallPolicy\PublicProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SharedAccess\Parameters\
FirewallPolicy\PublicProfile
DoNotAllowExceptions = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SharedAccess\Parameters\
FirewallPolicy\PublicProfile
DisableNotifications = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
DoNotAllowExceptions = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
DisableNotifications = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\Services\SharedAccess
Start = "4"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = "1"

Dropping Routine

This Trojan drops the following files:

  • %User Temp%\3780061Log.txt
  • %User Temp%\{random filename}.exe

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other Details

This Trojan connects to the following possibly malicious URL:

  • https://{BLOCKED}.{BLOCKED}.83.19/misi12.png
  • https://{BLOCKED}.{BLOCKED}.6.123/misi12.png
  • https://{BLOCKED}.{BLOCKED}.219.230/misi12.png
  • https://{BLOCKED}.{BLOCKED}.153.138/misi12.png
  • https://{BLOCKED}.{BLOCKED}.193.145/misi12.png
  • https://{BLOCKED}.{BLOCKED}.64.223/misi12.png
  • https://{BLOCKED}.{BLOCKED}.102.70/misi12.png
  • https://{BLOCKED}.{BLOCKED}.119.204/misi12.png
  • https://{BLOCKED}.{BLOCKED}.103.232/misi12.png
  • https://{BLOCKED}.{BLOCKED}.100.49/misi12.png
  • https://{BLOCKED}.{BLOCKED}.99.183/misi12.png
  • https://{BLOCKED}.{BLOCKED}.242.203/misi12.png
  • https://{BLOCKED}.{BLOCKED}.30.118/misi12.png
  • https://{BLOCKED}.{BLOCKED}.19.168/misi12.png
  • https://{BLOCKED}.{BLOCKED}.207.151/misi12.png
  • https://{BLOCKED}.{BLOCKED}.211.242/misi12.png
  • http://{BLOCKED}.{BLOCKED}.4.90:{port}/MIS12/{Host Name}/

It deletes itself after execution.