Stripping Upatre Trojan Downloader
Upatre is a trojan downloader widely used to download banking botnets . It recently started using compression and XOR encoding . Upatre comes with a custom packer . After unpacking real nasty evil code is revealed . Unpacking Upatre is little bit tricky . Following Blog post will show you how to unpack and rebuild Upatre.
This is what Upatre looks like when you open it up in a debugger .
If we skip the decoding routine . We land at OEP which looks something like this.
Calls like CALL DWORD PRT SS :[EBP + 30] are windows API calls. Before jumping to the OEP all the API call addresses are pushed on to the stack . So building a IAT for this type of packer would be a tricky job .
Tracing API calls. #
For tracing the destination of all these indirect API calls made after OEP , we will parse a trace file . One thing to take care of is the installer and downloader . So we have to trace for both the installer and downloader basic blocks . This can be done by patching some jumps in the file .
A jump is where the installation path is checked with the current path , another is when the original file is set up for deletion .
After running the trace on both the patched and non-patched binaries , we will concatenate the result and get the following result ( only CALL’s are filtered out )
We will log the destination address of these Each API calls . For that purpose we will create an immunity debugger’s pycommand script to log the API calls .
Sample pycommands file to hook at CALL [EBP =- X ] functions
from immlib import LogBpHook
dbg = immlib.Debugger()
def run(self, regs):
imm = immlib.Debugger()
opc = imm.disasm(regs['EIP'])
CallDis = opc.getDisasm()
imm.log("Disasm = %s" % CallDis[CallDis.find("[") + 5: CallDis.find("]") ])
disp = int(CallDis[CallDis.find("[") + 5: CallDis.find("]") ], 16)
addrx = regs['EBP'] + disp
imm.log("Address = %d" % addrx)
addr = imm.readLong(addrx)
fp = open("addrs.txt", "a")
fp.write(imm.getFunction(addr).getName() +","+ str(regs['EIP'])"\n")
bplist = 
fp =open("Calls.txt", "r")
for i in fp:
logbp = Myhook()
for i in bplist:
funcName = dbg.getFunction(i).getName()
This script will parse the run trace file and will put a log breakpoint on each function to recode the destination and save it in a file .
Later on we can read the file and name the indirect functions again using a
fp = open("addrs.txt", "r")
dbg = immlib.Debugger()
for line in fp:
addr = int(line.split(","),10)
name = line.split(",")
This script will automatically generate names at the indirect call addresses.
Creating a Loader for dump file #
Upatre OEP code is a position independent code , but it depends on address pushed on the stack after dumping the .text section we can place it inside a PE skeleton and place our loader there .
For a skeleton exe we will use this awesome nasm file :(http://www.phreedom.org/research/tinype/) by Alexander Sotirov.
And in the loader stub we will copy all the stack address and push it .
After compiling this nasm file , we will get an exe file as an output with all names and strings visible .