Description

The Fun/Troll functions in malware serve as a form of digital mischief, allowing attackers to toy with their victims by triggering a variety of benign but disruptive actions. These can range from opening and closing the CD-ROM drive, hiding the desktop icons, to disabling the start button or menu. More aggressive actions might include freezing the mouse cursor or turning the screen black. While these functions may seem playful or harmless at first glance, they often serve a dual purpose. First, they can distract the user or IT department, causing them to waste time on resolving seemingly trivial issues while the malware carries out its primary malicious activities undetected. Second, these actions can act as a smoke screen, generating a flurry of confusing system logs that make it more challenging to trace the malware's true activities. In this way, what appears to be 'trolling' can actually be a tactical maneuver within a broader attack strategy.

Existing Techniques

Name	Associated Feature(s)	Has Snippet	Matching Sample
Clipboard Disabling	Clipboard Manager, Fun / Troll Functions		0
Control CD/DVD Tray	Fun / Troll Functions		10

Associated with Releases

Version	Origins	Authors	Languages	Release Date
CIA 1.0	England 🏴󠁧󠁢󠁥󠁮󠁧󠁿	Alchemist	Visual Basic 6 (VB6)	Mar, 2003
Z-dem0n 1.26	Unknown 🏴‍☠️	ZnAsH	Delphi	Mar, 2003
CIA 1.1	England 🏴󠁧󠁢󠁥󠁮󠁧󠁿	Alchemist	Visual Basic 6 (VB6)	Apr, 2003
Beast 2.00	Romania 🇷🇴	Tataye	Delphi	May, 2003
Beast 2.01	Romania 🇷🇴	Tataye	Delphi	Jun, 2003
A-311 Death 1.03	Russia 🇷🇺	Corpse	Assembly, MASM	Aug, 2003
Optix Pro 1.32	Unknown 🏴‍☠️	s13az3 , xMs	Delphi	Sep, 2003
CIA 1.2	England 🏴󠁧󠁢󠁥󠁮󠁧󠁿	Alchemist	Visual Basic 6 (VB6)	Sep, 2003
Beast 2.05	Romania 🇷🇴	Tataye	Delphi	Sep, 2003
Beast 2.02	Romania 🇷🇴	Tataye	Delphi	Sep, 2003
ProRat 1.1	Turkey 🇹🇷	HighLander , ATmaCA	Borland C++	Jan, 2004
Hue 1.0	Unknown 🏴‍☠️	B33T	Visual Basic 6 (VB6)	Jan, 2004
ProRat 1.2	Turkey 🇹🇷	HighLander , ATmaCA	Borland C++	Jan, 2004
ProRat 1.3	Turkey 🇹🇷	HighLander , ATmaCA	Borland C++	Feb, 2004
Nuclear RAT 1.0 Beta 5	Brazil 🇧🇷	caesar2k	Delphi	Feb, 2004
Beast 2.06	Romania 🇷🇴	Tataye	Delphi	Feb, 2004
ProRat 1.4	Turkey 🇹🇷	HighLander , ATmaCA	Borland C++	Feb, 2004
LanFiltrator 1.5 Beta III	Australia 🇦🇺	Read101	Delphi	Feb, 2004
ProRat 1.6	Turkey 🇹🇷	HighLander , ATmaCA	Borland C++	Mar, 2004
ProRat 1.8	Turkey 🇹🇷	HighLander , ATmaCA	Borland C++	Mar, 2004
acid Drop 1.5	Unknown 🏴‍☠️	acid_alchemy	Visual Basic 6 (VB6)	Apr, 2004
Infector NG 2004 2.1.0	Belgium 🇧🇪, United Kingdom 🇬🇧	fc , Infiltration	Delphi	May, 2004
Messiah 1.0	Unknown 🏴‍☠️	Splinter	Visual Basic 6 (VB6)	Jul, 2004
Optix Pro 1.33	Unknown 🏴‍☠️	s13az3	Delphi	Aug, 2004
Beast 2.07	Romania 🇷🇴	Tataye	Delphi	Aug, 2004
Erazer 1.0	Austria 🇦🇹	(v)aster	Delphi	Aug, 2004
CIA 1.3	England 🏴󠁧󠁢󠁥󠁮󠁧󠁿	Alchemist	Visual Basic 6 (VB6)	Dec, 2004
Messiah 4.0	Unknown 🏴‍☠️	Splinter	Visual Basic 6 (VB6)	Jan, 2005
ProRat 1.9	Turkey 🇹🇷	HighLander , ATmaCA	Borland C++	Mar, 2005
Y3K rat 2k5 RC 1.0	Austria 🇦🇹	SHA	Delphi	Jun, 2005
CyberNetic 1.62 (PE)	Unknown 🏴‍☠️, Spain 🇪🇸	Cybernetic crew , mHKm , shukisnike	Delphi	Aug, 2005
Y3K rat 2k5 RC 1.1	Austria 🇦🇹	SHA	Delphi	Nov, 2005
Turkojan 3.0	Turkey 🇹🇷	Fungus	Delphi	Sep, 2006
Casper Demo	Unknown 🏴‍☠️	loog	Visual Basic 6 (VB6)	Oct, 2006
Hav-Rat 1.2	Sweden 🇸🇪	Havalito	Delphi	Feb, 2007
Bandook 1.35	Lebanon 🇱🇧	PrinceAli	Delphi, C++	Apr, 2007
BlasterX 1.5	France 🇫🇷	BlasterZ , Blastwar	Visual Basic 6 (VB6)	Apr, 2007
BlasterX 1.5 Flash The World	France 🇫🇷	BlasterZ , Blastwar	Visual Basic 6 (VB6)	Apr, 2007
DARKMOON 4.11 Private Edition	Spain 🇪🇸	shukisnike	Delphi	Aug, 2007
Nuclear RAT 2.1.0	Brazil 🇧🇷	caesar2k	Delphi	Sep, 2007
Bump-Rat 1.2 Beta	France 🇫🇷	Scraniak	Visual Basic 6 (VB6)	Sep, 2007
Lost Door 1.0	Tunisia 🇹🇳	OussamiO	Visual Basic 6 (VB6)	Jan, 2008
ZombieRat 1.2	Romania 🇷🇴	The Bo$$	Assembly, Delphi	Jan, 2008
Lost Door 2.0	Tunisia 🇹🇳	OussamiO	Visual Basic 6 (VB6)	Feb, 2008
Turkojan 4	Turkey 🇹🇷	FµNGµ§	Delphi	Feb, 2008
Turkojan 4.0	Turkey 🇹🇷	Fungus	Delphi	Mar, 2008
SynRAT 1.0	France 🇫🇷	DarkCoderSc	Delphi	Aug, 2008
TeraBIT Virus Maker 2.9 SE	Iran 🇮🇷	m_reza00	Visual Basic 6 (VB6)	Jan, 2009
Lost Door 3.0 Stable	Tunisia 🇹🇳	OussamiO	Visual Basic 6 (VB6)	Mar, 2009
SynRAT 4.0.1	France 🇫🇷	DarkCoderSc	Delphi	May, 2009