Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #71473
Copy of Anti-Sandboxing: Wait for Mouse Click
Overview
The Trojan Upclicker (as reported by eEye) uses the SetWindowsHookExA API with the WH_MOUSE_LL parameter to wait until the user lets up the left mouse button (WM_LBUTTONUP) before performing any malicious functionality (then it injects into Explorer.exe).
A sandbox environment that does not mimic mouse actions (probably most of them) will never execute the malicious behavior. This is probably effective against Kaspersky and others.
Source
The Trojan Upclicker
Component Reuse
None