Win32/Mooze [Threat Name]

Detection created2003-05-07
Short description

The trojan has a simple payload. The trojan sets the desktop and dialog boxes color to black.

Installation

When executed, the trojan copies itself into the following location:

  • %system%\­Pbt32.exe

In order to be executed on every system start, the trojan sets the following Registry entry:

  • [HKEY_LOCAL_MACHINE\­Software\­Microsoft\­Windows\­CurrentVersion\­Run]
    • "Pbt32" = %system%\­Pbt32.exe

The following Registry entries are set:

  • [HKEY_CURRENT_USER\­Control Panel\­Colors]
    • "ActiveBorder" = "0 0 0"
    • "ActiveTitle" = "0 0 0"
    • "AppWorkspace" = "0 0 0"
    • "Background" = "0 0 0"
    • "ButtonAlternateFace" = "0 0 0"
    • "ButtonDkShadow" = "0 0 0"
    • "ButtonFace" = "0 0 0"
    • "ButtonHilight" = "0 0 0"
    • "ButtonLight" = "0 0 0"
    • "ButtonShadow" = "0 0 0"
    • "ButtonText" = "0 0 0"
    • "GradientActiveTitle" = "0 0 0"
    • "GradientInactiveTitle" = "0 0 0"
    • "GrayText" = "0 0 0"
    • "Hilight" = "0 0 0"
    • "HilightText" = "0 0 0"
    • "HotTrackingColor" = "0 0 0"
    • "InactiveBorder" = "0 0 0"
    • "InactiveTitle" = "0 0 0"
    • "InactiveTitleText" = "0 0 0"
    • "InfoText" = "0 0 0"
    • "InfoWindow" = "0 0 0"
    • "Menu" = "0 0 0"
    • "MenuText" = "0 0 0"
    • "Scrollbar" = "0 0 0"
    • "TitleText" = "0 0 0"
    • "Window" = "0 0 0"
    • "WindowFrame" = "0 0 0"
    • "WindowText" = "0 0 0"
  • [HKEY_CURRENT_USER\­Control Panel\­Desktop]
    • "Wallpaper" = "0"
Other information

The trojan displays a fake error message:

  • Run Error.
  • This file is not a valid Win32 application.

The trojan may display the following messages:

  • PitchBlack Trojan
  • Ok, You've Had Your Fun Now...
  • I'm Giving You ONE Last Chance To Turn Off Your Computer Within 1 Hour!
  • Better NOT Turn On Your Computer Again Today.
  • Merry (Dark) Christmas!
  • Too bad you don't listen to ppl coz u just activated The Pitch Black Trojan By [Mooze / Spawned Vikings]

Please enable Javascript to ensure correct displaying of this content and refresh this page.