Threat Database Trojans Trojan.Upatre.LB

Trojan.Upatre.LB

Threat Scorecard

Threat Level: 80 % (High)
Infected Computers: 15
First Seen: September 6, 2024
Last Seen: October 17, 2026
OS(es) Affected: Windows

Trojan.Upatre.LB is a dangerous Windows-based Trojan horse program designed to infiltrate computers quietly and open the door to further malicious activity. Rated at a high danger level, this threat is capable of giving attackers significant control over an infected system, making it a serious concern for both home users and businesses alike.

What Trojan.Upatre.LB Does

Once it finds its way onto a system, Trojan.Upatre.LB installs itself stealthily and runs silently in the background, often without any obvious signs to alert the user. It is a 32-bit Windows executable that typically lacks digital signatures, version information, and other legitimate markers that normal software usually carries — a common trait among threats designed to evade detection and analysis.

This Trojan is known to use suspicious system functions, such as hooking into Windows processes, which can allow it to monitor activity, intercept data, or manipulate how other programs behave on the infected machine. After it establishes itself, Trojan.Upatre.LB can covertly delete files, download and install additional malware, and potentially hand over control of the compromised system to remote attackers.

How It Usually Gets Onto Computers

Trojan.Upatre.LB commonly spreads by exploiting system vulnerabilities and security flaws that have not been patched. It is also frequently distributed through malicious software downloads from compromised or untrustworthy websites. Another common delivery method is email — the Trojan can be disguised as attachments with extensions such as .exe, .pif, .avi, or even .jpg, tricking users into opening what appears to be a harmless file.

Because these files are often disguised to look legitimate or harmless, users may unknowingly execute the Trojan themselves simply by opening an attachment or downloading a file from an untrusted source.

Risks for the User

The consequences of a Trojan.Upatre.LB infection can be severe. Once active, this threat may allow cybercriminals to gain extensive control over the compromised computer. This can lead to the theft of sensitive information, unauthorized access to files, and the installation of additional malware such as ransomware, spyware, or other Trojans. Users may also experience system instability, performance issues, or unexpected changes to files and settings as a result of the infection.

Signs of Infection

Because Trojan.Upatre.LB is built to operate stealthily, it may not produce obvious symptoms right away. However, users should watch for warning signs such as:

  • Unexplained system slowdowns or crashes
  • Unusual network activity or increased data usage
  • Files disappearing or being modified without explanation
  • Unknown programs or processes running in the background
  • Security software being disabled or malfunctioning unexpectedly

How to Stay Protected

To reduce the risk of infection from threats like Trojan.Upatre.LB, users should keep their operating system and all installed software fully updated, as this helps close security vulnerabilities that malware often exploits. Avoid downloading software from unofficial or suspicious websites, and never open email attachments from unknown or untrusted senders, especially files with executable extensions like .exe or .pif.

Maintaining regular backups of important files, using a reputable and up-to-date security solution, and exercising caution when browsing the internet or handling email attachments are essential steps toward protecting your system from this and similar Trojan threats.

Analysis Report

General information

Family Name: Trojan.Upatre.LB
Signature status: No Signature

Known Samples

MD5: 6b51460eaa630d341a8bfb2afbc7a339
SHA1: a6c4fb81f1971cbd7afd3e0d28573902685618e5
SHA256: 2E78FF9952BB11C542946A59B2C13EA77C85336DA3C4C63E0A1AC0124917F788
File Size: 278.53 KB, 278528 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have relocations information
  • File doesn't have resources
  • File doesn't have security information
  • File is 32-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
Show More
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Traits

  • No Version Info
  • x86

Block Information

Total Blocks: 319
Potentially Malicious Blocks: 105
Whitelisted Blocks: 214
Unknown Blocks: 0

Visual Map

x 0 x x x x x x x x x 0 x x x 0 x x 0 x x x x x x x x x x x x x 0 x x 0 x 0 x x x x x x x x x x x x x x x x x x x x x x x x x 0 x x x x x x x x x x 0 x x x x x x x x x x x x x x x x x x x x 0 x x x x x 0 0 x x x 0 0 0 x 0 x x x x x x x x 0 0 0 0 0 0 x 0 0 x 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • Upatre.LB

Files Modified

File Attributes
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

Key::Value Data API Name
HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name a6c4fb81f1971cbd7afd3e0d28573902685618e5_0000278528 RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::id 話㤠 RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 �n8��"ajg�8 �� �v ��T��������%��Bx#��$kF%�&� (�(X�(�)�`*J*9*�"-!R1`1�1HO1��5,]=�@V�A��D�G�IH[uH�pK��N$N�a$b"hc�wg�Xh�rj�bk`k�ql(�lR p*q�Xr�BtǤvy�w�ny�9 RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 �n�8��"ajg�8 �� �v ��T��������%��Bx#��$kF%�&� (�(X�(�)�`*J*9*�",=�-!R1`1�1HO1��5,]=�@V�A��D�G�IH[uH�pK��N$N�a$b"hc�wg�Xh�rj�bk`k�ql(�lR p*q�Xr�BtǤvy�w�n RegNtPreCreateKey

Windows API Usage

Category API
Other Suspicious
  • SetWindowsHookEx