Upatre - Trojan Downloader

secrary.com/ReversingMalware/Upatre/

cd ../reverse_engineering_malware 6 minutes read
You can get the sample from theZoo

SHA-256:  1b893ca3b782679b1e5d1afecb75be7bcc145b5da21a30f6c18dbddc9c6de4e7

We can use behavior analysis from hybrid-analysis.

Seems like there is no known protection mechanism.

In the strings, there is nothing important other than this base64 encoded string:

1/13

…and imports is not eloquent but there is our friend  GetProcAddress :

Let’s open in  IDA :

sub_403760  is used to get necessary Win API functions:

2/13

Inside  sub_403760 , malware decrytes strings and uses 
addresses of functions:
GetProcAddress  to get

To decrypt strings before call  GetProcAddress ,  Upatre  uses following decryption routine:

3/13

Inside  sub_402F30  malware uses this teqnique to get addresses for following Win API
functions:

NtAllocateVirtualMemory
WaitForSingleObject
RtlDecompressBuffer

The decryption routine is used heavily by malware in different places to get plain text.

,  NtUnmapViewOfSection ,  CreateThread ,
,  LoadLibraryA ,  HeapAlloc ,  RtlAllocateHeap ,
,  FlushInstructionCache ,  NtGetContextThread .

4/13

At  00403572 ,  Upatre  decodes base64 encoded string and saves at 
renamed variable as  decrypted_bin ):

At  0040386D  it creates a new thread:

004051B0 (I

5/13

Main work starts inside the thread at  00403900
several Win API functions:  CreateProcessW
NtSetContextThread , etc.

Creates itself as a new process in suspended mode and saves

Anti-Debug:

, Where it decryptes and gets addresses for
,  ExitProcess ,  NtWriteVirtualMemory ,

Context :

6/13

There is one interesting anti-debug trick, at the start, it saves 
value  [PEB+2]  in XOR decryption routine, outside of a debugger this value is 
adding  0  don’t cause any error, but if we try to add 
the executable is inside a debugger) it may cause error
RtlDecompressBuffer  returns  0xC0000242 (ST
error.

PEB  and uses  BeingDebug
0  and
1  (which is the value of  [PEB+2]  if
. In this case
ATUS_BAD_COMPRESSION_BUFFER)

The reason of this error is that before calling  RtlDecompressBuffer , malware
decrypts(with XOR) decoded strings using  0x4C+[PEB+2]  which is  0x4D  inside a
debugger instead of  0x4C , because of this result is corrupted output.

[eax+2]  is the value of  BeingDebug :

7/13

We can use  ScyllaHide

Decompresses decoded and decrypted base64 string using 
COMPRESSION_FORMAT_LZNT1

…and writes into suspened process:

After decompress it calls

plugin for  IDA  to defeat this anti-debug method.

):

NtSetContextThread

RtlDecompressBuffer  (format

, value of  EIP  is  401265 :

8/13

Resumes thread and exits:

Before  NtResumeProcess

Close  IDA  and start analyzing of the child process.

Tries to read  uttE047.tmp

call attach  x32dbg  to child process and set  EIP  to  401265 :

file from  %TEMP%  directory without success:

9/13

Creates one and writes location of the executable:

Inside of  uttE047.tmp  file:

Copies executale to  %TEMP%  directory as  utilview.exe :

10/13

…and creates as new process:

This process is exactly same as the first process, creates a new process and injects
decoded and decompressed code.

Let’s reverse last part (injected code) a little bit higher level.

Now we are here: sample.exe -> sample.exe -> utilview.exe -> utilview.exe

The injected code is also same as before it checks  uttE047.tmp  file, but this time there is
uttE047.tmp  in  %TEMP%  directory and malware goes a different direction, reads the
content of  uttE047.tmp , which is the location of the executable and removes that
executable:

11/13

After this it gets IP of the victim using

Also, there is a typo in user-agent string:

and parses IP from returned file:

checkip.dyndns.com :

12/13

It tries to download  questd.pdf
content/uploads/questd.pdf
content/uploads/2014/11/questd.pdf

from 
 and  http://yumproject.com/wp-

Sends  GET  requests to 
from victim’s IP address, 
95.181.46.38
B  is instead of

That’s all…  Upatre ’s main function is to download malicious files.

Note

If you prefer you can use my script to extract payload instead of doing it manually:

I know, I overlook many things related to 
something interesting please contact me.

I’m new to reversing malware and any kind of feedback is helpful for me.

Twitter: @_qaz_qaz

http://penangstreetfood.net/wp-

without success.

with client related information, last string derives
.

Upatre , due to my limited knowledge, if you find

13/13