{"id":3763,"date":"2012-03-08T09:44:57","date_gmt":"2012-03-08T17:44:57","guid":{"rendered":"http:\/\/blog.intego.com\/?p=3763"},"modified":"2016-02-12T10:13:46","modified_gmt":"2016-02-12T18:13:46","slug":"flashback-malware-new-variant-changes-twitter-hashtags","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/flashback-malware-new-variant-changes-twitter-hashtags\/","title":{"rendered":"Flashback Malware: New Variant Changes Twitter Hashtags"},"content":{"rendered":"

We recently reported on how the Flashback malware was using Twitter as a command and control center<\/a>, using a correspondence table between dates and four-letter strings, combining them to make twelve-letter strings. The malware sends HTTP requests to Twitter ever hour, searching for these hashtags, and only those tweets posted since the last time it checked, but we have yet to find any actual tweets containing them.<\/p>\n

After our blog post, the latest variant contains a slightly different correspondence table. One letter in most of the four-letter codes has changed, and one is the same. Here are the new codes:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
0<\/td>\ngsqj<\/td>\n18<\/td>\nkddd<\/td>\n<\/tr>\n
1<\/td>\ndljt<\/td>\n19<\/td>\nneal<\/td>\n<\/tr>\n
2<\/td>\nyxad<\/td>\n20<\/td>\nhcca<\/td>\n<\/tr>\n
3<\/td>\nkpdh<\/td>\n21<\/td>\ndqzo<\/td>\n<\/tr>\n
4<\/td>\nizaw<\/td>\n22<\/td>\nkxag<\/td>\n<\/tr>\n
5<\/td>\npepb<\/td>\n23<\/td>\nvpqt<\/td>\n<\/tr>\n
6<\/td>\nezvn<\/td>\n24<\/td>\nwdld<\/td>\n<\/tr>\n
7<\/td>\nhwbd<\/td>\n25<\/td>\nnsiy<\/td>\n<\/tr>\n
8<\/td>\nd2ir<\/td>\n26<\/td>\nmlvo<\/td>\n<\/tr>\n
9<\/td>\nrnep<\/td>\n27<\/td>\nrdel<\/td>\n<\/tr>\n
10<\/td>\nuqdw<\/td>\n28<\/td>\nzdxl<\/td>\n<\/tr>\n
11<\/td>\njfng<\/td>\n29<\/td>\ndlno<\/td>\n<\/tr>\n
12<\/td>\nxloa<\/td>\n30<\/td>\nbcti<\/td>\n<\/tr>\n
13<\/td>\nrpdg<\/td>\n31<\/td>\neoof<\/td>\n<\/tr>\n
14<\/td>\naefl<\/td>\n32<\/td>\nmsan<\/td>\n<\/tr>\n
15<\/td>\nocur<\/td>\n33<\/td>\nxlco<\/td>\n<\/tr>\n
16<\/td>\ndppu<\/td>\n34<\/td>\njsiq<\/td>\n<\/tr>\n
17<\/td>\njeuv<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

We’re certain that this change was made because we published the previous codes. We will continue publishing them each time we find new codes.<\/p>\n","protected":false},"excerpt":{"rendered":"

We recently reported on how the Flashback malware was using Twitter as a command and control center, using a correspondence table between dates and four-letter strings, combining them to make twelve-letter strings.<\/p>\n","protected":false},"author":3,"featured_media":8755,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[190],"tags":[153,1939,86,134],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\n\n\t\n\t\n\t\n