diff --git a/_includes/footer.html b/_includes/footer.html index 614a929..fd4924b 100644 --- a/_includes/footer.html +++ b/_includes/footer.html @@ -6,7 +6,7 @@
- © 1994-2022 Check Point Software Technologies LTD | All rights reserved | Property of CheckPoint.com + © 1994-2024 Check Point Software Technologies LTD | All rights reserved | Property of CheckPoint.com diff --git a/_techniques/human-like-behavior.md b/_techniques/human-like-behavior.md index 21f5c25..a9a08aa 100644 --- a/_techniques/human-like-behavior.md +++ b/_techniques/human-like-behavior.md @@ -169,10 +169,40 @@ Such a short delay of only 2 seconds implies that the user should be active at t
+More sophisticated checks rely on detection of not only the mouse movement per se but the pattern of such movement. The following example is taken from the research of LummaC2 Stealer conducted by Outpost24. + +First, malware captures mouse movements with the delay of 50 msec between them. + +
+
+
+ +
+ +Second, the vectors are drawn out of paired captured positions. + +
+
+
+ +
+ +Next, the angles are calculated between the corresponding vectors. + +
+
+
+ +
+ +Finally, the angles are compared with the 45.0º threshold value, and if any of the angles is bigger than this hardcoded value, malware treats the result as being suspicious and does not execute the malicious code. + +
+ Countermeasures

-Implement the module for mouse movement during a sample emulation. +Implement the module for mouse movement during a sample emulation. Make sure to come up with a more delicate way of interacting with the mouse cursor rather than just random movements all around the screen, so that it resembles the behavior of a human being.

2.2. Check via a request for user interaction

diff --git a/assets/images/trigonometry_mouse_check_1.webp b/assets/images/trigonometry_mouse_check_1.webp new file mode 100644 index 0000000..2f299f8 Binary files /dev/null and b/assets/images/trigonometry_mouse_check_1.webp differ diff --git a/assets/images/trigonometry_mouse_check_2.webp b/assets/images/trigonometry_mouse_check_2.webp new file mode 100644 index 0000000..eb071eb Binary files /dev/null and b/assets/images/trigonometry_mouse_check_2.webp differ diff --git a/assets/images/trigonometry_mouse_check_3.webp b/assets/images/trigonometry_mouse_check_3.webp new file mode 100644 index 0000000..0783de1 Binary files /dev/null and b/assets/images/trigonometry_mouse_check_3.webp differ