Eric.freyssinet: Created page with "{{Publication |Botnet=Upatre, |Year=2014 |Date=2014-12-11 |Editor=Microsoft malware protection centre |Link=http://blogs.technet.com/b/mmpc/archive/2014/12/11/wire-transfer-sp..."

2014-12-14T13:25:48Z

Created page with "{{Publication |Botnet=Upatre, |Year=2014 |Date=2014-12-11 |Editor=Microsoft malware protection centre |Link=http://blogs.technet.com/b/mmpc/archive/2014/12/11/wire-transfer-sp..."

New page

{{Publication
|Botnet=Upatre,
|Year=2014
|Date=2014-12-11
|Editor=Microsoft malware protection centre
|Link=http://blogs.technet.com/b/mmpc/archive/2014/12/11/wire-transfer-spam-spreads-upatre.aspx
|Type=Blogpost
|Abstract=The attachment contains a malicious ZIP file. We have seen it use the name payment1872.zip, but this can change at any time. The file extracts as an SCR file that imitates a screen saver or an Adobe PDF document as shown in the example below:

Extracted Upatre file

Figure 2: The extracted file imitates an Adobe PDF or screen saver

Trojan:Win32/Upatre is installed when this file is opened.

During the past week, our telemetry showed this threat was predominately seen in North America and attempts to compromise both consumer and enterprise machines.
}}

Wire Transfer Spam Spreads Upatre - Revision history

Eric.freyssinet: Created page with "{{Publication |Botnet=Upatre, |Year=2014 |Date=2014-12-11 |Editor=Microsoft malware protection centre |Link=http://blogs.technet.com/b/mmpc/archive/2014/12/11/wire-transfer-sp..."