View source for Trojan moves its configuration to Twitter, LinkedIn, MSDN and Baidu

{{Publication
|Image=socialcfg1.png
|Legend=
|Document=
|Licence=
|Video=
|Link=http://blogs.norman.com/2012/security-research/trojan-moves-its-configuration-to-twitter-linkedin-msdn-and-baidu blogs.norman.com
|Author=Snorre Fagerland, 
|NomRevue=Norman Blog
|Date=26 mars 2012
|Editor=Norman
|Year=2012
|ISBN=
|Page=
|Abstract=Sogu (alias Thoper, TVT, Destory Rat etc) is a large remote access trojan that has been used in a number of intrusions and targeted attacks. One of these was the large scale intrusion into servers owned by SK Communications in South Korea July 2011, where personal information of up to 35 million users (!) of the CyWorld and Nateon services were compromized.

The Command&Control servers, through which Sogu communicates with its masters, are typically defined in an encoded configuration block near the end of the trojan.
|Botnet=, 
|Malware=Sogu, Thoper, TVT, Destory Rat, 
|CCProtocol=, 
|Operation=, 
|Keyword=, 
}}