Trojan.Upatre.VAM

The detection of Trojan.Upatre.VAM on your system indicates a potential security threat that requires immediate attention. This detection name suggests a type of malicious software, but without more specific information, it's essential to understand the general characteristics of Trojan-type threats and how to address them.

What Is Trojan.Upatre.VAM?

Trojan-type threats are malicious programs that deceive users by disguising themselves as legitimate software. They can be designed to perform a variety of harmful actions, including data theft, unauthorized access to systems, and the installation of additional malware. The name Trojan.Upatre.VAM itself does not directly indicate a specific malware family, but it suggests that the detected threat could be related to or behave similarly to Trojans, which are known for their stealthy and deceptive nature.

How Trojan.Upatre.VAM Operates

Trojan-type threats typically operate by exploiting vulnerabilities in software or by tricking users into installing them. Once installed, they can communicate with their command and control servers to receive instructions, which might include stealing sensitive information, downloading additional malware, or using the infected system for malicious activities such as spamming or launching attacks on other systems. The exact operation of Trojan.Upatre.VAM would depend on its specific design and purpose, which could range from financial fraud to disruption of service.

Symptoms of Infection

Systems infected with Trojan-type threats may exhibit a range of symptoms, including but not limited to, unusual system behavior, unexpected pop-ups, slower system performance, and unexplained changes to system settings or files. In some cases, the infection may not display obvious symptoms, making it difficult for users to detect the malware without the aid of security software.

• Unexplained increases in network activity
• New, unfamiliar programs or icons
• Changes in browser settings or homepage
• Frequent system crashes or freezes

How to Remove Trojan.Upatre.VAM

1. Boot your system in Safe Mode with Networking to limit the malware's ability to interfere with the removal process.
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all related components of the threat.
3. Uninstall any recently installed programs that you do not recognize or that were installed around the time the threat was detected.
4. Reset your web browsers (Chrome, Firefox, Edge, etc.) to their default settings to remove any malicious extensions or settings changes made by the malware.
5. Reboot your system and perform another full scan to ensure that all components of the malware have been removed.

Conclusion

The removal of Trojan.Upatre.VAM requires careful and systematic steps to ensure that all components of the malware are eliminated from the system. It's also crucial to adopt preventive measures, such as keeping software up to date, using strong antivirus programs, and being cautious when opening email attachments or downloading software from the internet. By understanding the nature of Trojan-type threats and taking proactive steps, users can protect their systems and data from these and other types of malware.

Analysis Report

General information

Family Name:	Trojan.Upatre.VAM
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: c72443c61da50683e782b0b0f1557238 SHA1: 5379d8b90fd395087b6b1af1f42b693c8a80217c SHA256: 0D677634C420E60DD2ED2B2638924E47C1BA7D576C04AAE772E1EAE118C8987F File Size: 3.77 MB, 3768320 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

File Traits

• HighEntropy
• No Version Info
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Total Blocks:	82
Potentially Malicious Blocks:	2
Whitelisted Blocks:	80
Unknown Blocks:	0

Visual Map

x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\temp\1.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\2.exe	Generic Write,Read Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475	㵛 ȁ 獖}	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	沕 ⬉ʾ䈛x䠱O噀ñ᝹ʁ뽹ɞ傄ë횎ǜɼķ鶝’꾢ʊ閾ʴ淃駃ó⟋ʪ䧌VߙĤ⣳ġj鈄ĞꩠŖÉ	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	ShellExecute
Syscall Use	ntdll.dll!NtAlpcConnectPortEx ntdll.dll!NtAlpcCreateSecurityContext ntdll.dll!NtAlpcDeleteSecurityContext ntdll.dll!NtAlpcQueryInformation ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtAssociateWaitCompletionPacket ntdll.dll!NtClose ntdll.dll!NtCreateEvent ntdll.dll!NtCreateIoCompletion ntdll.dll!NtCreateTimer2 Show More ntdll.dll!NtCreateWaitCompletionPacket ntdll.dll!NtCreateWorkerFactory ntdll.dll!NtDuplicateObject ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtOpenDirectoryObject ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenThreadToken ntdll.dll!NtQueryFullAttributesFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationThread ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSetTimer2 ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtWriteFile UNKNOWN
Anti Debug	OutputDebugString
Network Winsock2	WSAGetOverlappedResult WSARecvFrom WSASendTo WSASocket WSAStartup WSAttemptAutodialName
User Data Access	GetComputerNameEx
Network Winsock	bind closesocket freeaddrinfo getaddrinfo getsockname setsockopt socket
Network Info Queried	GetAdaptersAddresses

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

open C:\Users\Ufrkntxq\AppData\Local\Temp\\1.exe

open C:\Users\Ufrkntxq\AppData\Local\Temp\\2.exe