{"id":724,"date":"2009-03-12T14:53:47","date_gmt":"2009-03-12T13:53:47","guid":{"rendered":"http:\/\/blog.intego.com\/?p=724"},"modified":"2009-03-12T14:53:47","modified_gmt":"2009-03-12T13:53:47","slug":"new-variant-of-rsplug-trojan-hackers-taunt-intego-again","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/new-variant-of-rsplug-trojan-hackers-taunt-intego-again\/","title":{"rendered":"New Variant of RSPlug Trojan: Hackers Taunt Intego Again"},"content":{"rendered":"<p>Last December, <a href=\"https:\/\/www.intego.com\/mac-security-blog\/yet-another-variant-of-the-rsplug-trojan-horse-this-one-taunts-intego\/\">we reported on a variant of the RSPlug Trojan horse that was taunting Intego<\/a> through certain bits of code and the name of a file it created. Well, the hackers are at it again. A new variant of this Trojan horse &#8211; RSPlug.F &#8211; is running wild, with a large number of versions being found on web sites. This time, the &#8220;installer&#8221; is called MacCinema, and, like the December model, it is again taunting Intego. This time, it contains the following code:<\/p>\n<p><b>niagasekirtsogetni 666 nigeb<br \/>\n<\/b><\/p>\n<p>If you look in a mirror, you can see that it says &#8220;begin 666 IntegoStrikesAgain&#8221;. This tells the system to create a file with read and write permissions (the 666 is a shortcut for Unix permissions, not anything to do with the \u201cnumber of the beast\u201d), and to create a file, containing the malicious code, named \u201cintegostrikesagain\u201d. While the code is backwards in the Trojan horse, it merely reads it backwards to be able to execute it. It seems that the hackers must have thought that Intego&#8217;s researchers would be fooled by backwards code. Well, VirusBarrier X5&#8217;s behavioral analysis spotted it right away. Better luck next time, guys&#8230; <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Last December, we reported on a variant of the RSPlug Trojan horse that was taunting Intego through certain bits of code and the name of a file it created. Well, the hackers are at it again. A new variant of this Trojan horse &#8211; RSPlug.F &#8211; is running wild, with a large number of versions [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[13],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v17.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<meta name=\"description\" content=\"Last December, we reported on a variant of the RSPlug Trojan horse that was taunting Intego through certain bits of code and the name of a file it\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intego.com\/mac-security-blog\/new-variant-of-rsplug-trojan-hackers-taunt-intego-again\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"New Variant of RSPlug Trojan: Hackers Taunt Intego Again  - The Mac Security Blog\" \/>\n<meta property=\"og:description\" content=\"Last December, we reported on a variant of the RSPlug Trojan horse that was taunting Intego through certain bits of code and the name of a file it\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intego.com\/mac-security-blog\/new-variant-of-rsplug-trojan-hackers-taunt-intego-again\/\" \/>\n<meta property=\"og:site_name\" content=\"The Mac Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2009-03-12T13:53:47+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Peter James\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#organization\",\"name\":\"Intego\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/\",\"sameAs\":[],\"logo\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#logo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png\",\"contentUrl\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png\",\"width\":875,\"height\":875,\"caption\":\"Intego\"},\"image\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#logo\"}},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#website\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/\",\"name\":\"The Mac Security Blog\",\"description\":\"Keep Macs safe from the dangers of the Internet\",\"publisher\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.intego.com\/mac-security-blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/new-variant-of-rsplug-trojan-hackers-taunt-intego-again\/#webpage\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/new-variant-of-rsplug-trojan-hackers-taunt-intego-again\/\",\"name\":\"New Variant of RSPlug Trojan: Hackers Taunt Intego Again - The Mac Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#website\"},\"datePublished\":\"2009-03-12T13:53:47+00:00\",\"dateModified\":\"2009-03-12T13:53:47+00:00\",\"description\":\"Last December, we reported on a variant of the RSPlug Trojan horse that was taunting Intego through certain bits of code and the name of a file it\",\"breadcrumb\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/new-variant-of-rsplug-trojan-hackers-taunt-intego-again\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.intego.com\/mac-security-blog\/new-variant-of-rsplug-trojan-hackers-taunt-intego-again\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/new-variant-of-rsplug-trojan-hackers-taunt-intego-again\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.intego.com\/mac-security-blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"New Variant of RSPlug Trojan: Hackers Taunt Intego Again\"}]},{\"@type\":\"Article\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/new-variant-of-rsplug-trojan-hackers-taunt-intego-again\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/new-variant-of-rsplug-trojan-hackers-taunt-intego-again\/#webpage\"},\"author\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/d0c16bd0a4dd8f82d91204f400c8d116\"},\"headline\":\"New Variant of RSPlug Trojan: Hackers Taunt Intego Again\",\"datePublished\":\"2009-03-12T13:53:47+00:00\",\"dateModified\":\"2009-03-12T13:53:47+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/new-variant-of-rsplug-trojan-hackers-taunt-intego-again\/#webpage\"},\"wordCount\":203,\"publisher\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#organization\"},\"articleSection\":[\"Security &amp; Privacy\"],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/d0c16bd0a4dd8f82d91204f400c8d116\",\"name\":\"Peter James\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#personlogo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/0626bfb4ada576ba5aa775322329ad47?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/0626bfb4ada576ba5aa775322329ad47?s=96&d=mm&r=g\",\"caption\":\"Peter James\"},\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/author\/peter\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"description":"Last December, we reported on a variant of the RSPlug Trojan horse that was taunting Intego through certain bits of code and the name of a file it","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intego.com\/mac-security-blog\/new-variant-of-rsplug-trojan-hackers-taunt-intego-again\/","og_locale":"en_US","og_type":"article","og_title":"New Variant of RSPlug Trojan: Hackers Taunt Intego Again  - The Mac Security Blog","og_description":"Last December, we reported on a variant of the RSPlug Trojan horse that was taunting Intego through certain bits of code and the name of a file it","og_url":"https:\/\/www.intego.com\/mac-security-blog\/new-variant-of-rsplug-trojan-hackers-taunt-intego-again\/","og_site_name":"The Mac Security Blog","article_published_time":"2009-03-12T13:53:47+00:00","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Peter James","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Organization","@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization","name":"Intego","url":"https:\/\/www.intego.com\/mac-security-blog\/","sameAs":[],"logo":{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/#logo","inLanguage":"en-US","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png","contentUrl":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png","width":875,"height":875,"caption":"Intego"},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#logo"}},{"@type":"WebSite","@id":"https:\/\/www.intego.com\/mac-security-blog\/#website","url":"https:\/\/www.intego.com\/mac-security-blog\/","name":"The Mac Security Blog","description":"Keep Macs safe from the dangers of the Internet","publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intego.com\/mac-security-blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-variant-of-rsplug-trojan-hackers-taunt-intego-again\/#webpage","url":"https:\/\/www.intego.com\/mac-security-blog\/new-variant-of-rsplug-trojan-hackers-taunt-intego-again\/","name":"New Variant of RSPlug Trojan: Hackers Taunt Intego Again - The Mac Security Blog","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#website"},"datePublished":"2009-03-12T13:53:47+00:00","dateModified":"2009-03-12T13:53:47+00:00","description":"Last December, we reported on a variant of the RSPlug Trojan horse that was taunting Intego through certain bits of code and the name of a file it","breadcrumb":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-variant-of-rsplug-trojan-hackers-taunt-intego-again\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intego.com\/mac-security-blog\/new-variant-of-rsplug-trojan-hackers-taunt-intego-again\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-variant-of-rsplug-trojan-hackers-taunt-intego-again\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.intego.com\/mac-security-blog\/"},{"@type":"ListItem","position":2,"name":"New Variant of RSPlug Trojan: Hackers Taunt Intego Again"}]},{"@type":"Article","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-variant-of-rsplug-trojan-hackers-taunt-intego-again\/#article","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-variant-of-rsplug-trojan-hackers-taunt-intego-again\/#webpage"},"author":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/d0c16bd0a4dd8f82d91204f400c8d116"},"headline":"New Variant of RSPlug Trojan: Hackers Taunt Intego Again","datePublished":"2009-03-12T13:53:47+00:00","dateModified":"2009-03-12T13:53:47+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-variant-of-rsplug-trojan-hackers-taunt-intego-again\/#webpage"},"wordCount":203,"publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"articleSection":["Security &amp; Privacy"],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/d0c16bd0a4dd8f82d91204f400c8d116","name":"Peter James","image":{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/#personlogo","inLanguage":"en-US","url":"https:\/\/secure.gravatar.com\/avatar\/0626bfb4ada576ba5aa775322329ad47?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/0626bfb4ada576ba5aa775322329ad47?s=96&d=mm&r=g","caption":"Peter James"},"url":"https:\/\/www.intego.com\/mac-security-blog\/author\/peter\/"}]}},"jetpack_featured_media_url":"","jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4VAYd-bG","amp_enabled":true,"_links":{"self":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/724"}],"collection":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/comments?post=724"}],"version-history":[{"count":0,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/724\/revisions"}],"wp:attachment":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media?parent=724"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/categories?post=724"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/tags?post=724"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}