In one of the recent posts from Symantec, researchers shared the analysis of a malware that could evade automatic analysis in a sandbox environment. Evasion was done by hooking to the mouse. Per the analysis, SetWindowsHookExA() API installs the _main_routine to monitor messages from the mouse. When the malware receives messages from the mouse—that is, if the mouse is moved or buttons are clicked—the main subroutine executes. Since the automated analysis system does not use the mouse, the code will remain dormant, hence bypassing analysis by a sandbox.
Recently, we came across another sample, called Trojan Upclicker, that went one step further: using a mouse to evade automated analysis. The purpose of this posting is to share some of the finer technical details of using a mouse to evade detection along with the malicious behavior of Trojan Upclicker.
