Upatre Continued to Evolve with new Anti
Unit 42 analyzes an undocumented Upatre downloader variant with VM detection via process hashing, packed code, disabled Windows defenses and Namecoin .bit C2 domains.
Unit 42 analyzed an Upatre downloader variant compiled in December 2016 that went largely undetected by automated systems, featuring heavy code flow obscuration, on-demand decryption of network communications, and novel virtual machine detection. The sample enumerates running processes, computes CRC32 hashes XORed with a hard-coded key, and sleeps if analysis-related processes such as vmtoolsd.exe or python.exe are found. It masquerades with Google Chrome icons, disables Windows Defender, Firewall and other security services, injects code into msiexec.exe, and resolves .bit Namecoin domains like bookreader[.]bit via hardcoded OpenNIC DNS servers over TCP.
- Upatre historically delivered Dyre, GameOver Zeus, Locky and Dridex, peaking above 250,000 monthly infections in 2015.
- The variant uses in-memory loading, stack pivoting with non-essential APIs, and multi-layered per-string encoding.
- It resolves .bit domains over TCP because Namecoin domains are outside ICANN regulation.
- ATT&CK
- T1105 Ingress Tool TransferT1027.002 Software PackingT1497.001 System ChecksT1562.001 Disable or Modify ToolsT1055 Process Injection
- Vendors
- Palo Alto Unit 42
- Products
- Upatre
- Organizations
- OpenNIC
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bookreader.bit | use them. This new sample attempts to resolve two domains, bookreader[.]bit and doghunter[.]bit via the following hardcoded DNS Serve |
| domain | doghunter.bit | ample attempts to resolve two domains, bookreader[.]bit and doghunter[.]bit via the following hardcoded DNS Servers: 31.3.135[.]232 1 |
| ipv4 | 104.238.186.189 | .183[.]146 84.201.32[.]108 185.133.72[.]100 96.90.175[.]167 104.238.186[.]189 DNS resolution for .bit domains use hardcoded DNS servers |
| ipv4 | 185.133.72.100 | .135[.]232 193.183.98[.]154 5.135.183[.]146 84.201.32[.]108 185.133.72[.]100 96.90.175[.]167 104.238.186[.]189 DNS resolution for .bit |
| ipv4 | 193.183.98.154 | bit via the following hardcoded DNS Servers: 31.3.135[.]232 193.183.98[.]154 5.135.183[.]146 84.201.32[.]108 185.133.72[.]100 96.90.17 |
| ipv4 | 31.3.135.232 | nd doghunter[.]bit via the following hardcoded DNS Servers: 31.3.135[.]232 193.183.98[.]154 5.135.183[.]146 84.201.32[.]108 185.133. |
| ipv4 | 5.135.183.146 | wing hardcoded DNS Servers: 31.3.135[.]232 193.183.98[.]154 5.135.183[.]146 84.201.32[.]108 185.133.72[.]100 96.90.175[.]167 104.238. |
| ipv4 | 84.201.32.108 | NS Servers: 31.3.135[.]232 193.183.98[.]154 5.135.183[.]146 84.201.32[.]108 185.133.72[.]100 96.90.175[.]167 104.238.186[.]189 DNS re |
| ipv4 | 96.90.175.167 | 3.98[.]154 5.135.183[.]146 84.201.32[.]108 185.133.72[.]100 96.90.175[.]167 104.238.186[.]189 DNS resolution for .bit domains use har |
| sha256 | 8ac7909730269d62efaf898d1a5e87251aadccf4349cd95564ad6a3634ba4ef4 | omise associated with this analysis include: Upatre SHA256: 8ac7909730269d62efaf898d1a5e87251aadccf4349cd95564ad6a3634ba4ef4 Cthonic SHA256: 94a8b4b22dab4171edde5b1bafbf2f17dbe3c3c4c01 |
| sha256 | 94a8b4b22dab4171edde5b1bafbf2f17dbe3c3c4c01335c36ba3b6e5d3635b83 | ample configured with the same dot-bit domains. The sample, 94a8b4b22dab4171edde5b1bafbf2f17dbe3c3c4c01335c36ba3b6e5d3635b83, was compiled six days after our Upatre sample and delivere |
From the original article
12 min read at unit42.paloaltonetworks.com
First discovered in 2013, Upatre is primarily a downloader tool responsible for delivering additional trojans onto the victim host. It is most well-known for being tied with the Dyre banking trojan, with a peak of over 250,000 Upatre infections per month delivering Dyre back in July 2015.
By Mike Harbison, Brittany Barbehenn · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.