Trojan Upclicker

Trojan Upclicker is a malware infection that hooks to the victim's mouse, giving Trojan Upclicker distinct advantages over other Trojan infections. Malware researchers first noticed Trojan Upclicker during an analysis of possible malware infections' methods to evade analysis in a virtual sandbox. Trojan Upclicker does this by hooking to the mouse. Trojan Upclicker has a component that detects when the mouse communicates with your computer (logging movements and clicks). Automated malware analysis systems do not use the mouse (due their automated nature), making it possible for Trojan Upclicker to bypass analysis. Without mouse movements or clicks, Trojan Upclicker will remain dormant, preventing PC security researchers from analyzing Trojan Upclicker in a controlled environment.

Trojan Upclicker specifically detects when the left mouse button is pressed or released. When Trojan Upclicker detects a mouse click, then Trojan Upclicker activates its malicious code. However, if the left mouse button is never released, then Trojan Upclicker will not activate, meaning that Trojan Upclicker will not run in an automated analysis situation. Trojan Upclicker injects its code into running processes abusing the Windows Explorer. By using the browser on the infected computer, Trojan Upclicker will try to connect to malicious domains (one such domain has been detected as sendmsg.jumpingcrab.com). After establishing a connection with this website, Trojan Upclicker will create a backdoor on the infected computer using ports 443 and 80. This backdoor can then be used to send and receive data to and from Trojan Upclicker as well as for carrying out other malicious tasks on the victim's computer.

An essential part of studying malware like Trojan Upclicker and creating ways for your anti-malware programs to detect and remove malicious applications is the use of a sandbox environment or a virtual machine. These are often automated. Basically, PC security researchers use virtual computers, which are purposefully infected with malware. This method makes it possible to analyze the behavior of malware in order to block their malicious websites and add them to security programs so that they will detect and remove them. However, Trojan Upclicker refuses to run on a virtual environment unless Trojan Upclicker detects mouse clicks. Since virtual machines are not meant to be used for regular work, they will often have no keyboard or mouse and simply exist to be infected with malware. By not running on a sandbox environment, Trojan Upclicker tries to prevent PC security researchers from studying Trojan Upclicker or developing ways to fight Trojan Upclicker.