Upatre is a Windows malware family first observed in 2013 and best characterized as a lightweight downloader used to deliver additional payloads onto compromised hosts. It has been widely associated with the delivery of banking trojans and other financially motivated malware, including Dyre, Gameover Zeus, Dridex, Chthonic, and ransomware such as CryptoLocker and CryptoWall. Upatre became especially prominent in large-scale crimeware distribution chains and was at times one of the most prevalent downloader families observed in the wild.
Upatre has commonly been distributed through malicious email attachments in phishing campaigns, including weaponized Office documents and compressed executables. Some campaigns used embedded-document techniques in which a malicious Office macro dropped an Upatre executable contained inside an RTF object rather than downloading it directly from the internet, improving evasion against signature-based and behavioral defenses. Upatre has also been observed in exploit-kit-driven delivery chains, including activity linked to RIG.
Functionally, Upatre serves as an initial-stage malware component that retrieves and executes follow-on payloads. Reported variants have also been capable of stealing user information. The family is notable for frequent updates and iterative anti-analysis improvements. Documented evasion methods include a simple sandbox check based on Windows system uptime via GetTickCount, causing the malware to terminate on recently booted systems commonly used in automated analysis environments. More advanced variants have used heavy code obfuscation, custom string and network-data encoding, packed or multi-stage decryption routines, virtual-machine detection based on running-process checks, in-memory code loading, and code injection into legitimate Windows processes.
Some Upatre variants have also taken post-compromise actions to weaken host defenses and maintain execution. Reported behaviors include disabling multiple Windows security services and protections, suppressing security notifications, altering user access control behavior, and establishing persistence through autorun policy mechanisms. Certain samples masqueraded as legitimate software to reduce suspicion.
Upatre is part of the broader financially motivated malware ecosystem and has been repeatedly used as a staging mechanism in campaigns that ultimately enabled credential theft, banking fraud, spam distribution, and ransomware deployment. Its operational role as a compact, adaptable downloader and its long-running use in phishing-driven intrusion chains made it a significant component of mid-2010s cybercrime activity.
