Evolution Of Upatre Trojan Downloader

**Executive Summary:** The report details the Upatre Trojan downloader campaign used to deliver banking malware (Dyreza, Zeus, Rovnix) via Cutwail spam and exploit kits, describing infection chains, evasion techniques (password-protected and nested attachments, randomized headers, encrypted downloads, SSL C2), C2 behavior (TCP port 40007), decryption routines, and network indicators including sample HTTP requests and hardcoded User-Agent strings (ENUPDATE, ONLYUPDATE, UPDATE).