Mouse Underlaying: Global Key and Mouse Listener Based on an Almost Invisible Window with Local Listeners and Sophisticated Focus

Witte, Tim Niklas

doi:10.4108/eai.15-10-2018.155740

Cited by 1 publication

(2 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In other words, both User Imitating variants will work perfectly. The victim can be fooled into confirming this message by applying a social engineering technique [71].…”

Section: Evaluation a Operating System Compatibilitymentioning

confidence: 99%

See 1 more Smart Citation

Phantom Malware: Conceal Malicious Actions From Malware Detection Techniques by Imitating User Activity

Witte

2020

IEEE Access

View full text Add to dashboard Cite

State of the art malware detection techniques only consider the interaction of programs with the operating system's API (system calls) for malware classification. This paper demonstrates that techniques like these are insufficient. A point that is overlooked by the currently existing techniques is presented in this paper: Malware is able to interact with windows providing the corresponding functionality in order to execute the desired action by mimicking user activity. In other words, harmful actions will be masked as simulated user actions. To start with, the article introduces User Imitating techniques for concealing malicious commands of the malware as impersonated user activity. Thereafter, the concept of Phantom Malware will be presented: This malware is constantly applying User Imitating to execute each of its malicious actions. A Phantom Ransomware (ransomware employs the User Imitating for every of its malicious actions) is implemented in C++ for testing anti-virus programs in Windows 10. Software of various manufacturers are applied for testing purposes. All of them failed without exception. This paper analyzes the reasons why these products failed and further, presents measures that have been developed against Phantom Malware based on the test results.

show abstract

“…In other words, both User Imitating variants will work perfectly. The victim can be fooled into confirming this message by applying a social engineering technique [71].…”

Section: Evaluation a Operating System Compatibilitymentioning

confidence: 99%

“…In this way it may be seen as a discrimination. Besides, tools for remote maintenance apply this functionality, too [71]. • A process shall be not allowed to switch to another (additional) desktop by employing a corresponding API call or terminal command without the user's awareness.…”

Section: Measures Against Phantom Malwarementioning

confidence: 99%

Phantom Malware: Conceal Malicious Actions From Malware Detection Techniques by Imitating User Activity

Witte

2020

IEEE Access

View full text Add to dashboard Cite

show abstract

Mouse Underlaying: Global Key and Mouse Listener Based on an Almost Invisible Window with Local Listeners and Sophisticated Focus

Cited by 1 publication

References 13 publications

Phantom Malware: Conceal Malicious Actions From Malware Detection Techniques by Imitating User Activity

Phantom Malware: Conceal Malicious Actions From Malware Detection Techniques by Imitating User Activity

Contact Info

Product

Resources

About