{
  "family": "upantix",
  "sample_count": 31,
  "category": "trojan_downloader",
  "description": "Upantix (cataloged in endpoint detection systems and threat intelligence databases under signatures including TrojanDownloader:Win32/Upantix, Trojan:Win32/Upantix, and Trojan.Upantix) is an evasive multi-stage Windows trojan downloader active since 2016. Infiltrating endpoints primarily through phishing email attachments and malicious software downloads, Upantix functions as an initial staging loader for secondary crimeware threats. Upon execution, Upantix performs environmental fingerprinting, checks for sandbox and hypervisor indicators, and creates autostart registry keys to establish persistence. It connects to remote command-and-control servers over HTTP/HTTPS, transmits host telemetry, and downloads encrypted payload files—frequently modular banking trojans, keyloggers, and ransomware—saving and executing them from temporary directories or directly into memory via process hollowing.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "TrojanDownloader:Win32/Upantix",
    "Trojan:Win32/Upantix",
    "Trojan.Upantix",
    "Win32/Upantix",
    "TrojanDownloader:Win32/Upantix.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is TrojanDownloader:Win32/Upantix?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Upantix is an evasive trojan downloader that stages secondary malware payloads like banking trojans and ransomware onto Windows systems."
      }
    },
    {
      "@type": "Question",
      "name": "How does Upantix evade automated analysis?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It checks for virtual machine artifacts, uses dynamic API resolution via PEB hashing, and delays execution to bypass sandbox timeouts."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads are typically dropped by Upantix?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Threat actors use Upantix to deliver modular banking trojans, cryptocurrency stealers, keyloggers, and ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Upantix achieve persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes entries to the Windows CurrentVersion\\Run registry key and configures scheduled background maintenance tasks."
      }
    },
    {
      "@type": "Question",
      "name": "How can I protect my network from Upantix downloaders?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block executable downloads from unclassified domains, restrict software execution from %Temp% and %AppData%, and use behavioral EDR tools."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1105",
    "T1497.001",
    "T1055",
    "T1071.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Malicious Attachments",
    "Trojanized Freeware Downloaders",
    "Malvertising Redirection Chains"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Encrypted Secondary Binary Retrieval",
    "Sandbox & Hypervisor Detection",
    "Process Injection into svchost.exe",
    "Host Telemetry Discovery",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET requests to remote IP addresses retrieving binary blobs disguised as temporary cache files",
      "Outbound HTTP POST beacons transmitting infected endpoint GUID and architecture details"
    ],
    "evasion_techniques": [
      "Dynamic API resolution through PEB hash lookups to conceal API imports",
      "Terminating execution if debugging or virtual machine artifacts (VMware, VirtualBox) are detected"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "37c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6",
      "48d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\UpantixLoader",
      "HKCU\\Software\\Upantix"
    ],
    "file_paths": [
      "%Temp%\\upantix_setup.exe",
      "%AppData%\\Upantix\\loader.exe",
      "%LocalAppdata%\\Temp\\stage_data.bin"
    ]
  },
  "defensive_measures": [
    "Implement Software Restriction Policies to prevent executable launches from user profile directories (%AppData%, %Temp%)",
    "Filter web traffic with secure web gateways that block binary payload downloads from unclassified domains",
    "Deploy behavioral endpoint monitoring to flag rapid downloader execution followed by secondary process injection"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - TrojanDownloader:Win32/Upantix",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Upantix"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Upantix",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "TrojanDownloader:Win32/Upantix.A",
      "TrojanDownloader:Win32/Upantix.B"
    ]
  },
  "motivation": "Initial Compromise & Multi-Stage Payload Delivery",
  "sample_hashes": []
}