Upatre Dropper Fires CryptoLocker Rules as Decade-Dormant Domain Wakes
A 27KB Windows executable disguised as a legal case file simultaneously triggers Upatre and CryptoLocker detection signatures, raising questions about dual-payload capability. Its C2 domain, registered in 2005, sat dormant for eleven years before being activated on commodity shared hosting for HTTPS-based command-and-control.
A Two-Decade-Old Domain and a Dropper That Speaks Two Malware Dialects
A 27-kilobyte Windows executable named case_10022013.exe sits at the centre of a delivery chain that has been quietly circulating since at least October 2013 — and the most analytically striking detail is not its age but its identity crisis. The binary is classified by 66 of 77 antivirus engines as Upatre, the compact downloader long associated with the Gold Evergreen / Business Club criminal ecosystem. Yet the same file simultaneously triggers two YARA rules from the McAfee Advanced Threat Research ruleset — CryptoLocker_set1 and CryptoLocker_rule2 — rules written specifically to detect CryptoLocker ransomware variants. That dual-family signal, combined with a C2 domain registered in 2005 that went dormant for more than a decade before receiving its first TLS certificate, paints a campaign whose operational fingerprint is more durable — and more ambiguous — than its modest file size suggests.
CTX Team has tracked this cluster under campaign identifier CTXqgffq6gpq6, with indicators spanning a first-seen date of October 2013 and activity recorded as recently as mid-2026. The overall evidence is rated low confidence (score 35 out of 100), and every analytical claim that goes beyond directly observed artefacts is hedged accordingly throughout this piece.
The Lure: Case-Themed ZIPs Engineered for Legal and Financial Inboxes
The campaign's initial-access mechanism [T1566.001] is straightforward in design and effective in execution. Victims receive what appears to be a ZIP archive carrying legal or case-file correspondence — the delivery container (SHA-256: b35bb439…) is recorded under at least four distinct filenames: Case_1171807.zip, Case_1787739.zip, Case_1171807-1.zip, and Case_5005915.zip. The naming convention is deliberate. Case numbers in the six-to-seven-digit range mimic the reference formats used by courts, debt-collection agencies, insurance adjusters, and financial compliance teams — precisely the kinds of documents that prompt an immediate open rather than a cautious pause.
The archive itself is structurally minimal: one child file, one file type, and an uncompressed payload of exactly 27,648 bytes. That figure matches the standalone executable to the byte, confirming the ZIP is a single-payload delivery vehicle rather than a multi-stage bundle. Both the container and the PE carry the spreader tag in the indicator catalog, consistent with Upatre's documented operational pattern of propagating through email as a socially engineered archive. The ZIP was first submitted to VirusTotal on 2013-10-02 and last seen on 2015-03-03, placing its active circulation window in the 2013–2015 period, though the campaign's infrastructure tells a longer story.
Neither the ZIP nor the executable carries a code-signing certificate. There is no certificate trust chain to abuse here — the lure works entirely through social engineering, relying on the recipient's expectation that a document named Case_1171807.zip contains something they need to open. That absence of signing is worth noting because it means the delivery chain cannot be disrupted by certificate revocation or allowlist-based binary trust policies; the only friction point is the recipient's own judgment.
Detection coverage for the ZIP container stands at 59 of 77 engines, with 18 engines returning no verdict — including Microsoft, CrowdStrike, and several mobile-focused products that are not relevant to this Windows-targeted campaign. The community vote record shows three malicious votes and zero harmless, consistent with a well-established malicious classification rather than a contested or ambiguous file.
The Dropper: When an Upatre Binary Fires CryptoLocker Rules
Once extracted and executed, case_10022013.exe (SHA-256: 2f43d3b8…) runs as a PE32 GUI binary compiled for Intel 80386 architecture — a 32-bit Windows executable whose PE timestamp aligns exactly with its first VirusTotal submission date of 2013-10-02, suggesting the sample was compiled and deployed in close succession rather than aged or reused from an earlier build. The file's PE section layout provides the first structural clue about its evasion posture: the .text section registers entropy at 6.04, the .rsrc section at 4.98, and the remaining sections (.rdata, .data, .reloc) fall between 3.44 and 4.25 — a profile that does not indicate aggressive runtime packing but is consistent with a compiled binary that has not been stripped of its original structure.
The more significant build-provenance signal is the import count: zero named imports. A PE with no entries in its import address table does not call Windows API functions through the standard loader mechanism — it resolves them dynamically at runtime, typically by walking the Process Environment Block to locate loaded modules and then hashing or comparing function names to find the addresses it needs [T1106]. This technique, sometimes called PEB walking or dynamic API resolution, is a foundational evasion primitive because it renders static import-table analysis — the first thing most automated scanners perform — entirely uninformative. The analyst's assessment is that this zero-import profile is consistent with the campaign's attributed MITRE evasion cluster, which includes process injection into a legitimate host process [T1055] to mask execution under a trusted binary, debugger evasion checks [T1622] that cause the implant to alter or abort its behaviour when running under analysis tooling, and indicator removal including file deletion [T1070.004] to reduce the forensic footprint left on a compromised host. Registry modification [T1112] and defense impairment [T1562.001] are also attributed to this cluster. It should be stated plainly, however, that direct sandbox behavioural logs confirming these specific techniques were not observed — they are inferred from the campaign's attributed MITRE techniques and should be treated as provisional pending deeper dynamic analysis.
What is directly confirmed is the Tencent HABO sandbox verdict: malicious, with a MALWARE classification. That single sandbox result, combined with a 66-of-77 AV consensus flagging the file as trojan.upatre/generickdv, establishes the binary's malicious character with high confidence. The popular name list includes upatre, generickdv, and zbot — the last of these being Zeus Bot, the credential-stealing banking trojan that Upatre was historically used to deliver. Eleven engines return no verdict on the executable, among them several products that do not cover legacy 32-bit PE formats comprehensively.
The analytically significant anomaly is the YARA dimension. The binary fires both CryptoLocker_set1 and CryptoLocker_rule2 from the RANSOM_Cryptolocker ruleset authored by Christiaan Beek of McAfee Advanced Threat Research — rules designed specifically to detect CryptoLocker samples and CryptoLocker variants respectively. A binary labelled as an Upatre downloader should not, in principle, match CryptoLocker detection rules. The analyst flags this as an outlier and identifies three plausible interpretations: the binary is a multi-payload dropper capable of fetching either a ZBot credential-stealer or a CryptoLocker-family ransomware payload as a second stage depending on operator instruction; the binary shares code or structural patterns with the CryptoLocker lineage at a level sufficient to trigger signature-based detection without being a CryptoLocker sample proper; or the McAfee ATR rules have sufficient breadth to capture shared code patterns across both families. The campaign is tagged with both cryptolocker as a target family and espionage as a motivation — a combination that, taken together, suggests either dual-use capability or a classification artefact that warrants deeper reverse-engineering triage before any firm conclusion is drawn. The current evidence is insufficient to resolve this question, and the dual-family characterisation should be treated as a hypothesis requiring confirmation.
The build provenance record carries imphash 5c55d83b58dbc1f7154223c32a893074, vhash 024056651d155517z11zdmz12fz, and ssdeep 384:v0VkMq01bJ3wtEwPS8HLEh+Jagz+3be+26Rsn1rCcOQtOOtEvwDpjqIGR:vQz7yVEhs9+js1SQtOOtEvwDpj. No other known file shares this imphash, and no shared certificate serial or nameserver record ties the executable to the domain. The two files in this campaign are structurally isolated from each other, which limits the ability to draw build-pipeline inferences from shared provenance.
The C2 Anchor: bestccc.com and the Eleven-Year Dormancy Gap
The campaign's command-and-control infrastructure [T1071.001] centres on a single domain: bestccc.com. Registered on 2005-12-16 through GoDaddy.com, LLC, the domain was approximately 7,490 days old at last check — a lifespan that spans two decades of internet history. Its first recorded TLS certificate was issued on 2016-12-12 by cPanel, Inc. Certification Authority, with a 90-day validity window running through 2017-03-12. The serial number for that certificate is 3c677e402ec3044079e3f9a62652d47b.
The arithmetic of that timeline is operationally significant. Between the domain's registration in December 2005 and its first HTTPS provisioning in December 2016, approximately eleven years elapsed. During that period, the domain appears to have been parked or dormant — not actively serving content, not provisioned with a TLS certificate, not configured for the kind of web-hosting infrastructure that would support a C2 endpoint. The cPanel-issued certificate, with its 90-day validity and automated provisioning model, is characteristic of shared-hosting environments where TLS is provisioned through the hosting panel's built-in certificate tooling rather than through a purpose-built PKI. This is not the infrastructure pattern of a well-resourced actor maintaining a dedicated server fleet; it is the pattern of an operator who acquired a domain years in advance — or inherited one — and later activated it on commodity shared hosting when it was needed.
The domain's current DNS configuration reinforces the shared-hosting reading. Its nameservers are ns1.appleg.in and ns2.appleg.in, its A-record resolves to 103.91.187.97, and its SPF record (v=spf1 a mx ip4:103.91.187.97 ~all) authorises that same IP for mail delivery — a configuration consistent with a shared-hosting account where the same IP handles both web and mail traffic. The IP 103.91.187.97 resolves without an associated AS owner, which means cross-campaign infrastructure correlation via hosting provider is not possible, and the geographic or organisational attribution of the C2 endpoint cannot be confirmed.
The domain is currently tagged nxdomain and potential-c2 in the indicator catalog, with a detection ratio of only 14 of 91 engines — meaning the substantial majority of security vendors do not flag it as malicious. That low-visibility posture is operationally useful: C2 traffic to a domain that most security products consider benign blends into routine web requests without triggering network-layer alerts.
What makes the domain's maintenance history particularly notable is its WHOIS lock status. Four EPP status codes are active: clientDeleteProhibited, clientRenewProhibited, clientTransferProhibited, and clientUpdateProhibited. These locks, applied at the registrar level, prevent the domain from being deleted, transferred, or modified without explicit registrar intervention. They are not the default state for a neglected or abandoned domain — they indicate that someone has actively maintained the registration and applied protective controls to prevent its loss or hijacking. The domain's registry expiry date is set for 2026-12-16, meaning the registrant has renewed it through its third decade of existence. That level of deliberate stewardship over a two-decade period is atypical for opportunistic infrastructure and suggests the domain holds operational value to whoever controls it.
One important caveat on the delivery-to-C2 linkage: the ZIP container's last-seen date is 2015-03-03, and the domain's first TLS provisioning was 2016-12-12 — a gap of nearly two years. The direct connection between the delivery artefacts and the C2 domain is plausible given their co-occurrence in the same campaign indicator set, but it is not directly confirmed by the available evidence. Any reconstruction of the full delivery-to-C2 chain should be treated as provisional.
The Uncharacterised File and the Limits of the Evidence Chain
A third file appears in the campaign's indicator catalog under SHA-256 66226b0f42bc5d73227ab2d1eb90dcae20e37ec4016b27796ad78f81bdd330c3. It is, in the analyst's assessment, entirely uncharacterised and cannot be placed at any stage of the attack chain.
This is not a minor gap. In a three-file campaign, one uncharacterised file represents a third of the observable payload surface. If this file is a second-stage payload — the ZBot credential-stealer or CryptoLocker-family ransomware that the Upatre dropper is assessed to fetch — then the impact stage of the attack chain is currently invisible. If it is a loader or an intermediate stage, the chain has an unresolved middle. If it is entirely unrelated to the other two files and was included in the indicator set in error, that would itself be a data-quality issue worth flagging.
The overall confidence score of 35 out of 100 reflects this reality directly. Of the three files, only the EXE (2f43d3b8…) qualifies as strong evidence — it has both a sandbox verdict and high AV consensus. The ZIP (b35bb439…) has high AV consensus at 59 of 77 but no sandbox verdict, making behavioural claims about what happens when the archive is processed inferential rather than observed. The third file has no metadata whatsoever. Neither file carries a code-signing certificate, which means supply-chain or signed-binary framing is entirely unsupported. The domain has a low detection ratio and no resolved IP ASN data, weakening infrastructure attribution. These are not caveats appended to an otherwise solid analysis — they are structural limitations that constrain what can be concluded.
One indicator remains unverified against VirusTotal, consistent with the third file's complete absence of metadata. Any attribution or impact assessment should be treated as provisional pending additional telemetry.
Gold Evergreen, Business Club, and the Espionage-Tooling Tension
The campaign is attributed to Gold Evergreen, also tracked under the alias Business Club. The attribution carries medium confidence. The tension worth noting is that the deployed toolchain — Upatre staging ZBot and CryptoLocker-family payloads — is more commonly associated with financially motivated cybercriminal operations: credential harvesting for banking fraud, ransomware deployment for extortion. The campaign's assessed motivation, however, is listed as espionage. That combination may indicate dual-use operations where credential collection serves intelligence objectives, or it may reflect intelligence collection as a precursor to financial exploitation, or it may be a classification artefact in the threat feed. The current evidence is insufficient to resolve the tension, and the motivation attribution should be read as a working hypothesis rather than a confirmed operational profile.
No historical arc claims or prior named campaign parallels are available for this cluster. Inventing a prior campaign history to fill that gap would not be honest analysis.
What the Dual-Family Signal and Dormant Infrastructure Say About Operational Posture
The most consequential analytical signal is not the infrastructure pattern or the delivery mechanism — both are well-understood Upatre tradecraft — but the dual-family YARA overlap on the dropper. A binary that simultaneously satisfies Upatre classification criteria and fires two CryptoLocker detection rules suggests one of two things: either the operator has built or acquired a dropper capable of fetching payloads from different malware families depending on the target or the operational objective, or the boundary between credential-theft and ransomware tooling in this ecosystem is more porous than family-level classification implies.
If the first interpretation is correct, the operator can pivot from financial fraud to destructive impact — or to espionage-oriented credential collection — from a single initial-access foothold, without changing the delivery mechanism or the lure design. The same Case_XXXXXXX.zip email that drops a ZBot credential-stealer against one target could, in principle, drop a CryptoLocker-family ransomware payload against another. That flexibility, if confirmed by deeper reverse-engineering, would represent a meaningful capability: the ability to modulate impact from a standardised delivery chain based on post-access operator decision-making rather than pre-deployment payload selection.
The infrastructure pattern tells a complementary story about operational posture. An eleven-year-dormant domain, maintained under four WHOIS locks, activated on commodity shared hosting with an automated 90-day TLS certificate, resolving to an IP with no available ASN data — this is a low-cost, low-visibility approach that trades operational sophistication for longevity and detection evasion. The domain's 14-of-91 detection ratio means it passes through most network-layer security controls without friction. The cPanel certificate means the operator did not need to invest in a dedicated PKI or a purpose-built server. The shared hosting environment means the C2 traffic blends into the noise of legitimate web requests to the same IP.
What this posture signals is that the operator's priority is persistence and low observability rather than operational speed or technical complexity. A domain maintained for two decades, renewed through 2026, protected by registrar-level locks, and activated only when needed is an infrastructure investment measured in years, not weeks. Whether that investment reflects a well-resourced state-aligned actor, a financially motivated criminal group with long operational horizons, or something in between cannot be determined from the current evidence. But the combination of a dual-family dropper whose classification remains unresolved and a C2 domain whose full activation history is unknown means that the visible surface of this campaign is almost certainly smaller than its actual operational footprint. The uncharacterised third file is the clearest marker of that gap — and the most important reason to treat the current picture as a partial view of a longer-running operation.