Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Upatre Continued to Evolve with new Anti-Analysis Techniques

Summary: Unit 42 analyzed a previously undocumented Upatre downloader sample compiled in December 2016 that was largely undetectable by automated detection systems when collected in March 2018. The variant obscures code flow through stack pivots, decrypts its .bit command-and-control domains only when needed, and evades virtual machines by hashing running process names with CRC32, XORing them with a hard-coded key, and comparing the results against a stored array.

Bottom line: Upatre peaked at over 250,000 infections per month delivering Dyre in July 2015, and this sample sat undetected for roughly 15 months after compilation - a reminder that a downloader's evasion work buys attackers time your detection stack may not recover.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related