Researchers find APT malware that monitors mouse clicks to evade detection

The malware also uses other techniques to evade detection from several types of security products, FireEye researchers say

Researchers from security vendor FireEye have uncovered a new APT (advanced persistent threat) that uses multiple detection evasion techniques, including the monitoring of mouse clicks, to determine active human interaction with the infected computer.

Called Trojan.APT.BaneChant, the malware is distributed via a Word document rigged with an exploit sent during targeted email attacks. The name of the document translates to "Islamic Jihad.doc."

"We suspect that this weaponized document was used to target the governments of Middle East and Central Asia," FireEye researcher Chong Rong Hwa said Monday in a blog post.

The attack works in multiple stages. The malicious document downloads and executes a component that attempts to determine if the operating environment is a virtualized one, like an antivirus sandbox or an automated malware analysis system, by waiting to see if there's any mouse activity before initiating the second attack stage.

Mouse click monitoring is not a new detection evasion technique, but malware using it in the past generally checked for a single mouse click, Rong Hwa said. BaneChant waits for at least three mouse clicks before proceeding to decrypt a URL and download a backdoor program that masquerades as a .JPG image file, he said.

The malware also employs other detection evasion methods. For example, during the first stage of the attack, the malicious document downloads the dropper component from an ow.ly URL. Ow.ly is not a malicious domain, but is a URL shortening service.

The rationale behind using this service is to bypass URL blacklisting services active on the targeted computer or its network, Rong Hwa said.

Similarly, during the second stage of the attack, the malicious .JPG file is downloaded from a URL generated with the No-IP dynamic DNS (Domain Name System) service.

After being loaded by the first component, the .JPG file drops a copy of itself called GoogleUpdate.exe in the "C:\ProgramData\Google2\" folder. It also creates a link to the file in the user's start-up folder in order to ensure its execution after every computer reboot.

This is an attempt to trick users into believing that the file is part of the Google update service, a legitimate program that's normally installed under "C:\Program Files\Google\Update\", Rong Hwa said.

The backdoor program gathers and uploads system information back to a command-and-control server. It also supports several commands including one to download and execute additional files on the infected computers.

As defense technologies advance, malware also evolves, Rong Hwa said. In this instance, the malware has used a number of tricks, including evading sandbox analysis by detecting human behavior, evading network-level binary extraction technology by performing multibyte XOR encryption of executable files, masquerading as a legitimate process, evading forensic analysis by using fileless malicious code loaded directly into the memory and preventing automated domain blacklisting by using redirection via URL shortening and dynamic DNS services, he said.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags malwarespywareintrusionFireEyeDesktop security

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?