www.trendmicro.com
Open in
urlscan Pro
2.19.225.40
Public Scan
URL:
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_upatre.smbg
Submission: On July 18 via api from US — Scanned from DE
Submission: On July 18 via api from US — Scanned from DE
Form analysis 1 forms found in the DOM
<form class="main-menu-search" aria-label="Search Trend Micro" data-equally-id="equally_ai___qcfiI">
<div class="main-menu-search__field-wrapper" id="cludo-search-form">
<table class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search" autocomplete="off" aria-label="search">
</td>
</tr>
</tbody>
</table>
</div>
</form>Text Content
Business
search close
* Solutions
* By Challenge
* By Challenge
* By Challenge
Learn more
* Understand, Prioritize & Mitigate Risks
* Understand, Prioritize & Mitigate Risks
Improve your risk posture with attack surface management
Learn more
* Protect Cloud-Native Apps
* Protect Cloud-Native Apps
Security that enables business outcomes
Learn more
* Protect Your Hybrid World
* Protect Your Hybrid, Multi-Cloud World
Gain visibility and meet business needs with security
Learn more
* Securing Your Borderless Workforce
* Securing Your Borderless Workforce
Connect with confidence from anywhere, on any device
Learn more
* Eliminate Network Blind Spots
* Eliminate Network Blind Spots
Secure users and key operations throughout your environment
Learn more
* See More. Respond Faster.
* See More. Respond Faster.
Move faster than your adversaries with powerful purpose-built XDR,
attack surface risk management, and zero trust capabilities
Learn more
* Extend Your Team
* Extend Your Team. Respond to Threats Agilely
Maximize effectiveness with proactive risk reduction and managed
services
Learn more
* Operationalizing Zero Trust
* Operationalizing Zero Trust
Understand your attack surface, assess your risk in real time, and
adjust policies across network, workloads, and devices from a single
console
Learn more
* By Role
* By Role
* By Role
Learn more
* CISO
* CISO
Drive business value with measurable cybersecurity outcomes
Learn more
* SOC Manager
* SOC Manager
See more, act faster
Learn more
* Infrastructure Manager
* Infrastructure Manager
Evolve your security to mitigate threats quickly and effectively
Learn more
* Cloud Builder and Developer
* Cloud Builder and Developer
Ensure code runs only as intended
Learn more
* Cloud Security Ops
* Cloud Security Ops
Gain visibility and control with security designed for cloud
environments
Learn more
* By Industry
* By Industry
* By Industry
Learn more
* Healthcare
* Healthcare
Protect patient data, devices, and networks while meeting regulations
Learn more
* Manufacturing
* Manufacturing
Protecting your factory environments – from traditional devices to
state-of-the-art infrastructures
Learn more
* Oil & Gas
* Oil & Gas
ICS/OT Security for the oil and gas utility industry
Learn more
* Electric Utility
* Electric Utility
ICS/OT Security for the electric utility
Learn more
* Federal
* Federal
Learn more
* Automotive
* Automotive
Learn more
* 5G Networks
* 5G Networks
Learn more
* Small & Midsized Business Security
* Small & Midsized Business Security
Stop threats with comprehensive, set-it-and-forget-it protection
Learn more
* Platform
* Vision One Platform
* Vision One Platform
* Trend Vision One
Our Unified Platform
Bridge threat protection and cyber risk management
Learn more
* AI Companion
* Trend Vision One Companion
Your generative AI cybersecurity assistant
Learn more
* Attack Surface Management
* Attack Surface Management
Stop breaches before they happen
Learn more
* XDR (Extended Detection & Response)
* XDR (Extended Detection & Response)
Stop adversaries faster with a broader perspective and better context to
hunt, detect, investigate, and respond to threats from a single platform
Learn more
* Cloud Security
* Cloud Security
* Trend Vision One™
Cloud Security Overview
The most trusted cloud security platform for developers, security
teams, and businesses
Learn more
* Attack Surface Risk Management for Cloud
* Attack Surface Risk Management for Cloud
Cloud asset discovery, vulnerability prioritization, Cloud Security
Posture Management, and Attack Surface Management all in one
Learn more
* XDR for Cloud
* XDR for Cloud
Extend visibility to the cloud and streamline SOC investigations
Learn more
* Workload Security
* Workload Security
Secure your data center, cloud, and containers without compromising
performance by leveraging a cloud security platform with CNAPP
capabilities
Learn more
* Container Security
* Container Security
Simplify security for your cloud-native applications with advanced
container image scanning, policy-based admission control, and container
runtime protection
Learn more
* File Storage Security
* File Storage Security
Security for cloud file/object storage services leveraging cloud-native
application architectures
Learn more
* Endpoint Security
* Endpoint Security
* Endpoint Security Overview
Defend the endpoint through every stage of an attack
Learn more
* XDR for Endpoint
* XDR for Endpoint
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Workload Security
* Workload Security
Optimized prevention, detection, and response for endpoints, servers,
and cloud workloads
Learn more
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Mobile Security
* Mobile Security
On-premises and cloud protection against malware, malicious
applications, and other mobile threats
Learn more
* Network Security
* Network Security
* Network Security Overview
Expand the power of XDR with network detection and response
Learn more
* XDR for Network
* XDR for Network
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Network Intrusion Prevention (IPS)
* Network Intrusion Prevention (IPS)
Protect against known, unknown, and undisclosed vulnerabilities in your
network
Learn more
* Breach Detection System (BDS)
* Breach Detection System (BDS)
Detect and respond to targeted attacks moving inbound, outbound, and
laterally
Learn more
* Secure Service Edge (SSE)
* Secure Service Edge (SSE)
Redefine trust and secure digital transformation with continuous risk
assessments
Learn more
* Industrial Network Security
* Industrial Network Security
Learn more
* 5G Network Security
* 5G Network Security
Learn more
* Email Security
* Email Security
* Email Security
Stop phishing, malware, ransomware, fraud, and targeted attacks from
infiltrating your enterprise
Learn more
* Email and Collaboration Security
* Trend Vision One™
Email and Collaboration Security
Stop phishing, ransomware, and targeted attacks on any email service
including Microsoft 365 and Google Workspace
Learn more
* OT Security
* OT Security
* OT Security
Learn about solutions for ICS / OT security.
Learn more
* XDR for OT
* XDR for OT
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Industrial Network Security
* Industrial Network Security
Industrial Network Security
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Threat Intelligence
* Threat Intelligence
Keep ahead of the latest threats and protect your critical data with
ongoing threat prevention and analysis
Learn more
* All Products, Services, and Trials
* All Products, Services, and Trials
Learn more
* Research
* Research
* Research
* Research
Learn more
* Research, News, and Perspectives
* Research, News, and Perspectives
Learn more
* Research and Analysis
* Research and Analysis
Learn more
* Security News
* Security News
Learn more
* Zero Day Initiatives (ZDI)
* Zero Day Initiatives (ZDI)
Learn more
* Services
* Our Services
* Our Services
* Our Services
Learn more
* Service Packages
* Service Packages
Augment security teams with 24/7/365 managed detection, response, and
support
Learn more
* Managed XDR
* Managed XDR
Augment threat detection with expertly managed detection and response
(MDR) for email, endpoints, servers, cloud workloads, and networks
Learn more
* Incident Response
* Incident Response
* Incident Response
Our trusted experts are on call whether you're experiencing a breach
or looking to proactively improve your IR plans
Learn more
* Insurance Carriers and Law Firms
* Insurance Carriers and Law Firms
Stop breaches with the best response and detection technology on the
market and reduce clients’ downtime and claim costs
Learn more
* Support Services
* Support Services
Learn more
* Partners
* Partner Program
* Partner Program
* Partner Program Overview
Grow your business and protect your customers with the best-in-class
complete, multilayered security
Learn more
* Managed Security Service Provider
* Managed Security Service Provider
Deliver modern security operations services with our industry-leading
XDR
Learn more
* Managed Service Provider
* Managed Service Provider
Partner with a leading expert in cybersecurity, leverage proven
solutions designed for MSPs
Learn more
* Cloud Service Provider
* Cloud Service Provider
Add market-leading security to your cloud service offerings – no matter
which platform you use
Learn more
* Professional Services
* Professional Services
Increase revenue with industry-leading security
Learn more
* Resellers
* Resellers
Discover the possibilities
Learn more
* Marketplace
* Marketplace
Learn more
* System Integrators
* System Integrators
Learn more
* Alliance Partners
* Alliance Partners
* Alliance Overview
We work with the best to help you optimize performance and value
Learn more
* Technology Alliance Partners
* Technology Alliance Partners
Learn more
* Our Alliance Partners
* Our Alliance Partners
Learn more
* Partner Tools
* Partner Tools
* Partner Tools
Learn more
* Partner Login
* Partner Login
Login
* Education and Certification
* Education and Certification
Learn more
* Partner Successes
* Partner Successes
Learn more
* Distributors
* Distributors
Learn more
* Find a Partner
* Find a Partner
Learn more
* Company
* Why Trend Micro
* Why Trend Micro
* Why Trend Micro
Learn more
* Customer Success Stories
* Customer Success Stories
Learn more
* The Human Connection
* The Human Connection
Learn more
* Industry Accolades
* Industry Accolades
Learn more
* Strategic Alliances
* Strategic Alliances
Learn more
* Compare Trend Micro
* Compare Trend Micro
* Compare Trend Micro
See how Trend outperforms the competition
Let's go
* vs. Crowdstrike
* Trend Micro vs. Crowdstrike
Crowdstrike provides effective cybersecurity through its cloud-native
platform, but its pricing may stretch budgets, especially for
organizations seeking cost-effective scalability through a true single
platform
Let's go
* vs. Microsoft
* Trend Micro vs. Microsoft
Microsoft offers a foundational layer of protection, yet it often
requires supplemental solutions to fully address customers' security
problems
Let's go
* vs. Palo Alto Networks
* Trend Micro vs. Palo Alto Networks
Palo Alto Networks delivers advanced cybersecurity solutions, but
navigating its comprehensive suite can be complex and unlocking all
capabilities requires significant investment
Let's go
* About Us
* About Us
* About Us
Learn more
* Trust Center
* Trust Center
Learn more
* History
* History
Learn more
* Diversity, Equity and Inclusion
* Diversity, Equity and Inclusion
Learn more
* Corporate Social Responsibility
* Corporate Social Responsibility
Learn more
* Leadership
* Leadership
Learn more
* Security Experts
* Security Experts
Learn more
* Internet Safety and Cybersecurity Education
* Internet Safety and Cybersecurity Education
Learn more
* Legal
* Legal
Learn more
* Investors
* Investors
Learn more
* Formula E Racing
* Formula E Racing
Learn more
* Latest News
* Latest News
* Latest News
Learn more
* Newsroom
* Newsroom
Learn more
* Events
* Events
Learn more
* Careers
* Careers
Learn more
* Webinars
* Webinars
Learn more
Back
Back
Back
Back
* Free Trials
* Contact Us
Looking for home solutions?
Under Attack?
Support
* Business Support Portal
* Business Community
* Virus and Threat Help
* Education and Certification
* Contact Support
* Find a Support Partner
Resources
* Trend Micro vs. Competition
* Cyber Risk Index/Assessment
* CISO Resource Center
* DevOps Resource Center
* What Is?
* Threat Encyclopedia
* Cloud Health Assessment
* Cyber Insurance
* Glossary of Terms
* Webinars
Log In
* Vision One
* Support
* Partner Portal
* Cloud One
* Product Activation and Management
* Referral Affiliate
Back
arrow_back
search
close
* Threat Encyclopedia
* Malware
* TROJ_UPATRE.SMBG
TROJ_UPATRE.SMBG
January 30, 2015
* Email
* Facebook
* Twitter
* Google+
* Linkedin
Analysis by: Francis Xavier Antazo
--------------------------------------------------------------------------------
ALIASES:
TrojanDownloader:Win32/Upatre.AF (Microsoft)
PLATFORM:
Windows
OVERALL RISK RATING:
DAMAGE POTENTIAL:
DISTRIBUTION POTENTIAL:
REPORTED INFECTION:
INFORMATION EXPOSURE:
*
Threat Type: Trojan
*
Destructiveness: No
*
Encrypted: Yes
*
In the wild: Yes
OVERVIEW
Infection Channel: Downloaded from the Internet, Dropped by other malware
This UPATRE variant is used by DYRE banking malware to arrive in systems via
spam emails.
To get a one-glance comprehensive view of the behavior of this Trojan, refer to
the Threat Diagram shown below.
This Trojan arrives on a system as a file dropped by other malware or as a file
downloaded unknowingly by users when visiting malicious sites.
It executes the downloaded files. As a result, malicious routines of the
downloaded files are exhibited on the affected system.
TECHNICAL DETAILS
File Size: Varies
File Type: EXE
Memory Resident: No
Initial Samples Received Date: 22 Oct 2014
Payload: Downloads files
Arrival Details
This Trojan arrives on a system as a file dropped by other malware or as a file
downloaded unknowingly by users when visiting malicious sites.
Installation
This Trojan drops the following copies of itself into the affected system and
executes them:
* %User Temp%\gjxqk.exe - modified copy of itself
(Note: %User Temp% is the user's temporary folder, where it usually is
C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000,
Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user
name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and
64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows
Server 2008, and Windows Server 2012.)
It drops the following copies of itself into the affected system:
* %User Temp%\gjxqk.exe
(Note: %User Temp% is the user's temporary folder, where it usually is
C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000,
Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user
name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and
64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows
Server 2008, and Windows Server 2012.)
Download Routine
This Trojan accesses the following websites to download files:
* http://{BLOCKED}lacademy.co.uk/css/2110out.osa
* http://{BLOCKED}ramica.com/css/2110out.osa
It saves the files it downloads using the following names:
* %User Temp%\anjki.exe
(Note: %User Temp% is the user's temporary folder, where it usually is
C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000,
Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user
name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and
64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows
Server 2008, and Windows Server 2012.)
It then executes the downloaded files. As a result, malicious routines of the
downloaded files are exhibited on the affected system.
SOLUTION
Minimum Scan Engine: 9.700
FIRST VSAPI PATTERN FILE: 11.226.07
FIRST VSAPI PATTERN DATE: 22 Oct 2014
VSAPI OPR PATTERN File: 11.227.00
VSAPI OPR PATTERN Date: 22 Oct 2014
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must
disable System Restore to allow full scanning of their computers.
Step 2
Identify and terminate files detected as TROJ_UPATRE.SMBG
[ Learn More ]
[ back ]
a. Windows Task Manager may not display all running processes. In this case,
please use a third-party process viewer, preferably Process Explorer, to
terminate the malware/grayware/spyware file. You may download the said tool
here.
b. If the detected file is displayed in either Windows Task Manager or Process
Explorer but you cannot delete it, restart your computer in safe mode. To do
this, refer to this link for the complete steps.
c. If the detected file is not displayed in either Windows Task Manager or
Process Explorer, continue doing the next steps.
To terminate the malware/grayware/spyware process:
1. Scan your computer with your Trend Micro product and take note of the name
of the malware/grayware/spyware detected.
2. Open Windows Task Manager. To do this, press CTRL+SHIFT+ESC.
3. View the list of all running programs. To do this:
• For Windows 2000, XP, Server 2003, Vista, 7 and Server 2008 users, click
the Processes tab.
• For Windows 8, 8.1 and Server 2012 users, click the Details tab.
4. In the list of running programs, locate a malware/grayware/spyware file
detected earlier.
5. Select the detected files, then press either the End Task or the End Process
button, depending on the version of Windows you are using.
6. Do the same for the remaining detected malware/grayware/spyware files in the
list of running programs.
7. To check if the malware/grayware/spyware process has been terminated, close
Task Manager, and then open it again.
8. Close Task Manager.
Step 3
Search and delete these files
[ Learn More ]
[ back ]
There may be some component files that are hidden. Please make sure you check
the Search Hidden Files and Folders checkbox in the More advanced options option
to include all hidden files and folders in the search result.
* %User Temp%\gjxqk.exe
* %User Temp%\anjki.exe
To delete malware/grayware component files:
1. Search for the following files:
* %User Temp%\gjxqk.exe
* %User Temp%\anjki.exe
Note: To do a search for the following files, right-click Start then click
Search... or Find..., depending on the version of Windows you are running.
For each file to be deleted, type its file name in the Named input box. In
the Look In drop-down list, select My Computer, then press Enter.
2. Once located, select the file then press SHIFT+DELETE to permanently delete
the file.
3. Repeat the said steps for all files listed.
Step 4
Scan your computer with your Trend Micro product to delete files detected as
TROJ_UPATRE.SMBG. If the detected files have already been cleaned, deleted, or
quarantined by your Trend Micro product, no further step is required. You may
opt to simply delete the quarantined files. Please check this Knowledge Base
page for more information.
Did this description help? Tell us how we did.
RELATED BLOG ENTRIES
* New DYRE Variant Hijacks Microsoft Outlook, Expands Targeted Banks
RELATED URLS
* http://{BLOCKED}ramica.com/css/2110out.osa
* http://theteflacademy.{BLOCKED}o.uk/css/2110out.osa
Try our services free for 30 days
* Start your free trial today
*
*
*
*
*
RESOURCES
* Blog
* Newsroom
* Threat Reports
* DevOps Resource Center
* CISO Resource Center
* Find a Partner
SUPPORT
* Business Support Portal
* Contact Us
* Downloads
* Free Trials
*
*
ABOUT TREND
* About Us
* Careers
* Locations
* Upcoming Events
* Trust Center
*
COUNTRY HEADQUARTERS
Trend Micro - United States (US)
225 East John Carpenter Freeway
Suite 1500
Irving, Texas 75062
Phone: +1 (817) 569-8900
Select a country / region
United States expand_more
close
THE AMERICAS
* United States
* Brasil
* Canada
* México
MIDDLE EAST & AFRICA
* South Africa
* Middle East and North Africa
EUROPE
* België (Belgium)
* Česká Republika
* Danmark
* Deutschland, Österreich Schweiz
* España
* France
* Ireland
* Italia
* Nederland
* Norge (Norway)
* Polska (Poland)
* Suomi (Finland)
* Sverige (Sweden)
* Türkiye (Turkey)
* United Kingdom
ASIA & PACIFIC
* Australia
* Центральная Азия (Central Asia)
* Hong Kong (English)
* 香港 (中文) (Hong Kong)
* भारत गणराज्य (India)
* Indonesia
* 日本 (Japan)
* 대한민국 (South Korea)
* Malaysia
* Монголия (Mongolia) and рузия (Georgia)
* New Zealand
* Philippines
* Singapore
* 台灣 (Taiwan)
* ประเทศไทย (Thailand)
* Việt Nam
Privacy | Legal | Accessibility | Site map
Copyright ©2024 Trend Micro Incorporated. All rights reserved
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1