Upatre: Old Dog, New [Anti-Analysis] Tricks
Summary: Unit 42 researchers used Palo Alto Networks AutoFocus to identify several thousand functionally identical Upatre downloader binaries with unique hashes, and analyzed a recent phishing campaign to document new anti-analysis routines. Upatre calls the ZwQuerySystemInformation API to check system idle time - querying SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION (0x0008) on Windows 7 and SYSTEM_PERFORMANCE_INFORMATION (0x0002) on Windows XP - and exits if the idle time is too low, a check meant to distinguish a real host from an analysis system.
What you should know: Upatre has iterated on its anti-analysis capabilities for nearly three years and still spreads through mass phishing campaigns whose subject and filename were unique per recipient, so signature-based detection alone leaves thousands of unique-hash binaries to contend with.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026