Threat Management, Malware

Never gonna live this down: Researchers ‘Rickrolled’ by malware

Researchers at Trend Micro found themselves the victims of a "Rickrolling" while analyzing a malware program that triggered multiple rules-based security alerts, most likely deliberately.

Rickrolling is a prank whereby someone is tricked into watching a video of English pop artist Rick Astley singing his famous song "Never Gonna Give You Up."

Detected as JOKE_CYBERAVI, the malware was discovered May 11 and created only roughly 90 minutes prior to its initial detection, Trend Micro explained in a blog post on Friday.

The joke malware, which was detected 26 times in total, came to Trend Micro's attention after triggered multiple rules that researchers created using the malware tracking tool Yara. After further analysis, Trend Micro determined that the prankster likely intentionally designed his malware to trigger the Yara rules to ensure that his creation was flagged and noticed.

The malware dropped an .AVI file that, upon execution, played Astley's famous number-one hit single. "Our theory is that this could be some kind of test created to test Yara rules within an organization, or it could be just someone playing a practical joke," wrote blog post author Stephen Hilt, Trend Micro senior threat researcher. "Either way, we enjoyed the throwback to the time when Rickrolling was popular."

Bradley Barth

As director of multimedia content strategy at CyberRisk Alliance, Bradley Barth develops content for online conferences, webcasts, podcasts video/multimedia projects — often serving as moderator or host. For nearly six years, he wrote and reported for SC Media as deputy editor and, before that, senior reporter. He was previously a program executive with the tech-focused PR firm Voxus. Past journalistic experience includes stints as business editor at Executive Technology, a staff writer at New York Sportscene and a freelance journalist covering travel and entertainment. In his spare time, Bradley also writes screenplays.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.