Threat behavior
Trojan:JS/Twitini.A is a detection for malicious JavaScript code that may be appended to pages on compromised web servers. When run, it may download and execute arbitrary files.
Payload
Downloads and executes arbitrary files
Trojan:JS/Twitini.A is a detection for obfuscated JavaScript code that may be appended to pages on compromised Web servers. When an affected page is loaded, the malware contacts search.twitter.com and requests a list of the top trending topics on Twitter for the week. It then uses this information, along with the current date, as inputs to a formula to generate a domain name, such as jikygipfir.com or dcopxmpfir.com. The malware’s authors register domains whose names they calculate using the same formula, and host arbitrary files on these sites for Trojan:JS/Twitini to download and execute.
At the time of publication these files did not appear to be available.
The malware creates a cookie for the affected Web site with a name of “rf5f6ds”, and a lifetime of one week, which is used to ensure that for each user, the malware runs only once per week per infected domain.
Analysis by David Wood
Prevention