{"id":12522,"date":"2016-07-06T09:00:42","date_gmt":"2016-07-06T13:00:42","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=12522"},"modified":"2019-11-15T06:55:48","modified_gmt":"2019-11-15T11:55:48","slug":"5-weirdest-modern-trojans","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/5-weirdest-modern-trojans\/12522\/","title":{"rendered":"Top 5 weirdest Trojans: funny, scary, and strange"},"content":{"rendered":"<p>Back in the days of MS-DOS, hackers created malware mainly for entertainment purposes, so there were a lot of bizarre and even funny viruses. For example, one simple piece of malware turned the image on the computer screen upside down. A virus called Madman showed users the glaring eyes of a red-faced maniac and told the victims that somebody was watching them and \u201cnothing can save you.\u201d It was chilling back in those days. Really.<\/p>\n<p>Of course, there were more dangerous viruses as well. In the year 2000 a criminal sent e-mail messages headed \u201cILoveYou\u201d that included the malicious attachment LOVE-LETTER-FOR-YOU.TXT.<b>vbs<\/b>, which was not a text file but rather a Visual Basic script. The \u201clove letter\u201d infected more than 3 million PCs all over the world. The malware was extremely successful: It was 2002\u2019s most widespread computer virus.<\/p>\n<p>But time marches on, and malware has been transformed into something far less entertaining and more malevolent: software meant for one simple purpose \u2014 to make its creators rich. Nonetheless, even now it\u2019s possible to find a few viruses that stand out from the crowd. In this post we\u2019ve gathered five examples of weird and wacky malware.<\/p>\n<h3>Sociable malware<\/h3>\n<p>Even the simplest malware can bring about an emotional response. For example, a classic Skype Trojan simply sent the message \u201cHi\u201d to everyone in its victims\u2019 contact list each time they were online. The result was pretty predictable: The friends and acquaintances responded \u2014 many of them simultaneously. For some users it was such a terrible experience that they called the malware \u201cthe worst virus an introvert can face.\u201d<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/Skype?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@Skype<\/a> Hi! I enter my acct today &amp;I saw this Is this a virus? cause it was sent to some of my contacts What can I do? <a href=\"http:\/\/t.co\/kv1dWpiREb\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/kv1dWpiREb<\/a><\/p>\n<p>\u2014 Vania \u3002\u309c\uff08\u309c\uff3e\u30a7\uff3e\u309c\uff09\u309c\u3002 (@Faithless_Dark) <a href=\"https:\/\/twitter.com\/Faithless_Dark\/status\/635675472488214528?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">August 24, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script> <\/p>\n<p>In fact, the virus added a phishing link to the greeting message, so it was not written <i>just<\/i> for fun. But the malware was memorable because every time it infected a PC it triggered a freaking tsunami of unwanted communications.<\/p>\n<h3>Greedy apps<\/h3>\n<p>Trojans that hijack computer performance to mine bitcoins aren\u2019t news. Last year, the developers of several popular Android apps decided to do the same, using smartphones for crunching instead. They even managed to keep it a secret for some time because most people do not install antivirus software on their mobile devices, and the devices were mining only when connected to a charger.<\/p>\n<p>But the idea was hopeless from the start. Usually, people use powerful PCs with expensive graphics cards to mine bitcoins because mining involves heavy parallel computing. Mobile devices have never been anywhere near powerful enough for the task: For example, if you\u2019d tried to mine one bitcoin on a top-of-the-line 2015 smartphone (say, the Galaxy S4), the calculations would\u2019ve take 34,000 years. Now it would probably take even longer, as bitcoins are getting harder to crunch. We guess the perpetrators didn\u2019t know much about bitcoins and how they are mined.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Why are tech giants betting on <a href=\"https:\/\/twitter.com\/hashtag\/BitCoin?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#BitCoin<\/a>? \u2013 <a href=\"http:\/\/t.co\/xcGx5EOPFC\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/xcGx5EOPFC<\/a> <a href=\"http:\/\/t.co\/MImFiCndcD\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/MImFiCndcD<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/585121100784398337?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">April 6, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script> <\/p>\n<h3>A kvetching Trojan<\/h3>\n<p>While most Android banking Trojans try to stay under the radar, there was one that <a href=\"https:\/\/cybernewsgroup.co.uk\/android-trojan-pesters-victims-wont-take-no-for-an-answer\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">took a rather different tack<\/a>: It tried victims\u2019 very last nerve.<\/p>\n<p>This Trojan started like many others, slipping onto a smartphone posing as a useful app. Then the malware continuously pestered victims by asking them to grant it admin privileges. When the user closed one window, the Trojan opened another, again and again. The only way to stop it was to power down the phone and restore it to its factory default settings \u2014 or to grant the requested rights to the pesky app. (Note: That would be a bad idea.)<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Banking Trojans: mobile\u2019s major cyberthreat <a href=\"https:\/\/twitter.com\/hashtag\/malware?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#malware<\/a> <a href=\"https:\/\/t.co\/qWtgJjbCjq\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/qWtgJjbCjq<\/a> <a href=\"http:\/\/t.co\/qpyQEJvYHG\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/qpyQEJvYHG<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/649215975485665280?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">September 30, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script> <\/p>\n<p>Sometimes it\u2019s easier to agree than to keep saying no. Worn out, users assigned the requested privileges to get peace, but the Trojan didn\u2019t stop there: It used the same tactics to become the default SMS app and then to harangue victims into sharing their credit card information. A toddler would envy such persistence.<\/p>\n<h3>Sir Knight<\/h3>\n<p>You might even meet a Don Quixote even among the modern Trojans. Last year, Wifatch, an unusual form of malware, came to light. Or maybe we should call it \u201cgoodware.\u201d Wifatch infected Wi-Fi routers and other connected devices and \u2026 patched them.<\/p>\n<p>In addition to updating the devices, the program left a message to owners with recommendations to change passwords and update firmware. The problem here is that people often leave the default passwords on their connected devices (routers, Internet of Things devices, etc.) and do not set up them properly. As a result criminals find easy ways to hack such gadgets. The \u201ckind Trojan\u201d attempted to protect people from these and similar troubles.<\/p>\n<p>By the time Wifatch was discovered, its network included tens of thousands of devices in China, Brazil, and the United States.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">How will the Internet of Things affect cybersecurity? \u2013 <a href=\"http:\/\/t.co\/fWScmf4QfQ\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/fWScmf4QfQ<\/a> <a href=\"http:\/\/t.co\/sAk1mcZPg5\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/sAk1mcZPg5<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/586174972156108800?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">April 9, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<h3>A Trojan full of contradictions<\/h3>\n<p>Triada is an Android Trojan whose behavior belies its power. And it is very powerful. This malware successfully hacks the very heart of Google\u2019s OS \u2014 the Zygote process \u2014 and it resides mostly in an infected device\u2019s RAM, which makes it extremely hard to detect.<\/p>\n<p>Finally, Triada has a modular structure. The structure is not unlike the <a href=\"https:\/\/en.wikipedia.org\/wiki\/project_ara\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">new smartphone concept by Motorola<\/a>, but here we\u2019re talking about software modules that fit the Trojan with new powerful features, so Triada can sweep through its armory for the most suitable \u201cweapon\u201d \u2014 and turn it on users.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Meet <a href=\"https:\/\/twitter.com\/hashtag\/Triada?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Triada<\/a>: the mobile malware that exists in RAM &amp; uses root to substitute system files <a href=\"https:\/\/t.co\/JGJUfxDuJ0\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/JGJUfxDuJ0<\/a> <a href=\"https:\/\/t.co\/jVIqttaylR\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/jVIqttaylR<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/705464133731426305?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">March 3, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script> <\/p>\n<p>If you still don\u2019t believe that this mobile malware is very dangerous, consider this: Security experts say that Triada is just as well written as a computer Trojan. Don\u2019t forget, Windows has been battling malware for years, whereas mobile operating systems are relatively new. <\/p>\n<p>All in all, Triada has a powerful structure but uses it surprisingly naively. Instead of stealing banking data or taking hacked gadgets hostage, it shows advertisements to its victims \u2014 like <a href=\"https:\/\/www.kaspersky.com\/blog\/tip-of-the-week-stop-adware\/11354\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">simple adware<\/a>. The Trojan also spoofs URLs loaded in the browser, and it changes the homepage and default search engine. <\/p>\n<p>As its final means of monetizing infected users, Triada waits for a user to buy something in one of the apps \u2014 a powerup, game currency, cool add-ons, or something else along those lines. The Trojan swoops in at the moment of purchase and steals the money sent to developers via SMS. <\/p>\n<p>We\u2019re not complaining, but we don\u2019t understand why criminals would create such a powerful and complex solution to fulfill these simple tasks. And besides, they must earn less than developers of traditional lockers or banking Trojans.<\/p>\n<blockquote class=\"twitter-pullquote\"><p>Five weird modern Trojans #malware<\/p><a href=\"https:\/\/twitter.com\/share?url=https%3A%2F%2Fkas.pr%2F3W6L&amp;text=Five+weird+modern+Trojans+%23malware\" class=\"btn btn-twhite\" data-lang=\"en\" data-count=\"0\" target=\"_blank\" rel=\"noopener nofollow\">Tweet<\/a><\/blockquote>\n<p>As you can see, unusual and odd Trojans still exist. But no matter how funny they can be, this malware is still dangerous \u2014 designed to steal money or personal data or otherwise wreak havoc.<\/p>\n<p>If you don\u2019t want to fight with kvetching Trojans, get buried in greetings from sociable Skype malware, or get acquainted with any of other 170 million malicious solutions detected in the first three months of this year, you need a powerful security solution. Kaspersky Internet Security Multi-Device protects your digital life: PC, Mac, and mobile gadgets.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Once, hackers wrote malware just for the fun of it, but now Trojans are serious business. However, here are five modern, weird malware samples that may be funny and strange, but they are still very dangerous.<\/p>\n","protected":false},"author":522,"featured_media":12523,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2683],"tags":[423,97,422,723,154],"class_list":{"0":"post-12522","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats","8":"tag-mobile-devices","9":"tag-security-2","10":"tag-threats","11":"tag-trojans","12":"tag-viruses"},"hreflang":[{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/5-weirdest-modern-trojans\/12522\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/5-weirdest-modern-trojans\/7376\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/5-weirdest-modern-trojans\/7396\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/5-weirdest-modern-trojans\/7343\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/5-weirdest-modern-trojans\/8615\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/5-weirdest-modern-trojans\/8555\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/5-weirdest-modern-trojans\/12410\/"},{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/5-weirdest-modern-trojans\/2293\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/5-weirdest-modern-trojans\/5827\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/5-weirdest-modern-trojans\/6395\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/5-weirdest-modern-trojans\/5381\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/5-weirdest-modern-trojans\/8127\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/5-weirdest-modern-trojans\/11924\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/5-weirdest-modern-trojans\/12410\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/5-weirdest-modern-trojans\/12522\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/5-weirdest-modern-trojans\/12522\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com\/blog\/tag\/mobile-devices\/","name":"mobile devices"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/12522","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/522"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=12522"}],"version-history":[{"count":2,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/12522\/revisions"}],"predecessor-version":[{"id":30227,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/12522\/revisions\/30227"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/12523"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=12522"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=12522"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=12522"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}