They're in the virus definition files... usually in the IDE files in the IDE folder. You're not going to find loose identities floating around; there are millions of identities, and they operate in all sorts of different ways.
When looking at the FlshPlyr family, the various detections actually overlap a bit, and indicate the kind of detection more than the specific release version of Flashback that is detected by them.
That said, most of the drive-by version of Flashback will be picked up by OSX/Flshplyr-D, and if by some chance it got itself installed prior to your scan (on-access scanning disabled, for example), you'll detect the other files as OSX/Flshplyr-E. Certain edge cases could show up as OSX/FlshPlyr-B.
OSX/FlshPlyr-A generally detects on the older variants that used the PDF and Flash exploits; OSX/FlshPlyr-C detects the malicious installer itself (where the end user has to run the PKG file and intentionally install Flashback).
All identities go through continuous updating to improve both the performance of the detection scans and the proactiveness of the detection logic. The analyses also get updated from time to time, to provide more information/change the threat prevalence, etc.
I hope that helps.
-
Andrew
Threat Researcher
SophosLabs
For our other self-service and peer-to-peer online support systems:
