Description

The Fun/Troll functions in malware serve as a form of digital mischief, allowing attackers to toy with their victims by triggering a variety of benign but disruptive actions. These can range from opening and closing the CD-ROM drive, hiding the desktop icons, to disabling the start button or menu. More aggressive actions might include freezing the mouse cursor or turning the screen black. While these functions may seem playful or harmless at first glance, they often serve a dual purpose. First, they can distract the user or IT department, causing them to waste time on resolving seemingly trivial issues while the malware carries out its primary malicious activities undetected. Second, these actions can act as a smoke screen, generating a flurry of confusing system logs that make it more challenging to trace the malware's true activities. In this way, what appears to be 'trolling' can actually be a tactical maneuver within a broader attack strategy.

Existing Techniques

Name	Associated Feature(s)	Has Snippet	Matching Sample
Clipboard Disabling	Clipboard Manager, Fun / Troll Functions		0
Control CD/DVD Tray	Fun / Troll Functions		10

Associated with Releases

Version	Origins	Authors	Languages	Release Date
PrjRAPTOR 1.8	United States 🇺🇸	Ryan.M	Visual Basic 6 (VB6)	Jul, 2009
Cerberus 1.0 Beta	United States 🇺🇸, United Kingdom 🇬🇧	Protocol , Steve10120 , 2sly , Sam	Delphi	Aug, 2009
Cerberus 1.01 Beta	United States 🇺🇸, United Kingdom 🇬🇧	Protocol , Steve10120 , 2sly , Sam	Delphi	Aug, 2009
Cerberus 1.02 Beta	United States 🇺🇸, United Kingdom 🇬🇧	Protocol , Steve10120 , 2sly , Sam	Delphi	Aug, 2009
Cerberus 1.03.4	United States 🇺🇸, United Kingdom 🇬🇧	Protocol , Steve10120 , 2sly , Sam	Delphi	Sep, 2009
Spy-Net 2.6	Brazil 🇧🇷	Raphael	Delphi	Oct, 2009
DarkComet RAT 1.3	France 🇫🇷	DarkCoderSc	Assembly, Delphi	Nov, 2009
Cerberus 1.03.5 Beta	United States 🇺🇸, United Kingdom 🇬🇧	Protocol , Steve10120 , 2sly , Sam	Delphi	Dec, 2009
DarkComet RAT 2.0 RC4	France 🇫🇷	DarkCoderSc	Delphi	Mar, 2010
CyberGate 1.04.8	United States 🇺🇸	johnyk	Delphi	Apr, 2010
Lost Door 4.3.1	Tunisia 🇹🇳	OussamiO	Visual Basic 6 (VB6)	Apr, 2010
DarkComet RAT 2.0 RC7	France 🇫🇷	DarkCoderSc	Assembly, Delphi	Jun, 2010
Lost Door 5.1	Tunisia 🇹🇳	OussamiO	Visual Basic 6 (VB6)	Oct, 2010
Coolvibes 1 Update 8	Spain 🇪🇸	Thor	Delphi	May, 2011
Xtreme RAT 2.9	Brazil 🇧🇷	Raphael	Delphi	Jul, 2011
DarkComet RAT 5.3	France 🇫🇷	DarkCoderSc	Assembly, Delphi	Jun, 2012
DarkComet RAT 5.3.1	France 🇫🇷	DarkCoderSc	Assembly, Delphi	Jun, 2012
Lost Door 9.2 Aws	Tunisia 🇹🇳	OussamiO	Visual Basic 6 (VB6)	Jan, 2022