Loading story…
Upatre, a malware downloader commonly spread through phishing emails, was observed using a simple anti-analysis technique to avoid detection in automated sandbox environments. The malware calls the Windows API GetTickCount and terminates if the infected system appears to have been running for less than roughly 12 minutes, a condition that often matches freshly booted virtual machines used for short-lived malware analysis.
The evasion tactic can cause Upatre samples to appear benign because they never execute their malicious payload during analysis. Researchers reported a surge in new Upatre samples using the method and noted that the downloader is frequently used to fetch the Dyre banking Trojan, which steals credentials. Palo Alto Networks said its WildFire platform mitigates the trick by modifying the GetTickCount return value so the malware believes the host has been running for hours.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks analyzed an Upatre sample discovered in March 2018 that used heavy obfuscation, process-hash-based virtual machine detection, in-memory loading, msiexec.exe injection, and persistence via a Run policy registry key. The variant also attempted to resolve the .bit domains bookreader[.]bit and doghunter[.]bit through hardcoded OpenNIC-associated DNS servers before sending encrypted HTTP POST traffic.
Palo Alto Networks said its WildFire analysis system defeats the technique by altering the GetTickCount return value so Upatre believes the machine has been running for hours and continues executing.
Brendan Griffin of Malcovery published a report covering the Upatre activity associated with the newly observed anti-analysis technique.
Palo Alto Networks reported recently detecting a surge of new Upatre samples using the uptime-check anti-analysis behavior, indicating the evasion method was being actively deployed in the wild.
The Upatre malware family added an anti-analysis technique that calls the Windows API GetTickCount and exits if system uptime is less than about 12 minutes, helping it evade short-lived sandbox analysis environments.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
researchcenter.paloaltonetworks.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a large-scale **malware distribution campaign** that used fake software offerings hosted on trusted platforms to infect users, with operators increasingly relying on **AI-assisted or “vibe-coded” development** to scale payload creation. McAfee identified more than **443 malicious ZIP archives** masquerading as AI tools, game cheats, VPNs, drivers, and decryptors, distributed via services including *Discord*, *SourceForge*, *FOSSHub*, *MediaFire*, and *mydofiles.com*. The campaign used **48 variants** of `WinUpdateHelper.dll` across **17 kill chains**, each with separate command-and-control infrastructure but linked through shared cryptocurrency wallet credentials, allowing researchers to trace monetization activity and victim distribution across countries including the US, UK, India, Brazil, France, Canada, and Australia. A separate but related report described another **multi-stage malware campaign** that also relied on deceptive delivery and evasion, using **.NET Ahead-of-Time (AOT) compilation** to hinder analysis and a host-scoring system to avoid sandboxes and low-value targets. In that intrusion chain, a phishing-delivered ZIP launched `KeyAuth.exe`, which fetched `bound_build.exe` and then deployed both the **Rhadamanthys infostealer** and an **XMRig** miner disguised as *MicrosoftEdgeUpdater*. The malware checked conditions such as RAM, uptime, document count, and active antivirus processes, and terminated itself if the environment scored below a threshold, showing a deliberate effort to evade detection while maximizing successful infections.
Jun 29, 2026
Elastic Security Labs’ analysis of roughly 100,000 Windows malware samples found **defense evasion** to be the most common ATT&CK tactic, followed by privilege escalation, execution, and persistence. Frequently observed behaviors included Windows Defender tampering, process injection, DLL side-loading, parent-PID spoofing, abuse of `Rundll32` and `Regsvr32`, malicious MSI installers, and NTDLL unhooking. Commodity malware increasingly used UAC-bypass techniques—including methods that abuse Windows’ trust in protected directories—alongside TrustedInstaller impersonation, elevated parent-process spoofing, and bring-your-own-vulnerable-driver activity. Security teams should prioritize behavioral detections for these elevation and evasion patterns, as well as monitoring for script hosts, WMI, scheduled tasks, Run keys, services, and credential-store access that commonly accompany malware execution and persistence.
Aug 26, 2026
A technical walkthrough demonstrated how **Windows Scheduled Tasks** can be abused to establish malware persistence, using a simple C proof of concept that creates a task named `MeowTask` to launch a payload at user logon with **SYSTEM** privileges and the highest run level. The author initially tested a payload that displayed a message box, then replaced it with one that writes a file after the message box failed to appear following reboot, illustrating how attackers can adapt payload behavior while keeping the persistence mechanism unchanged. The write-up also noted operational quirks during testing, including the task only working in the author’s virtual machine when the laptop was connected to power rather than running on battery. The technique aligns with tradecraft previously associated with threat actors including **APT17** and **APT41**, reinforcing that scheduled task creation remains a practical persistence method defenders should monitor for, particularly unusual or unauthorized tasks that may be detectable or blockable through EDR controls.
Aug 15, 2026