The variants of Flashback (some AV vendors are calling it Flashfake) and “Sabpub” have kept me busy. Most of the Flashback variants going around seem to be based off of two “masters”, which were the most copied, changed, and redistributed. As of the writing of this blog post I’ve written 20 signatures for Flashback and only one for “Subpub”. More variants will come in, I’m quite sure, and we’ll keep our eye for them.”]
Source: https://blog.talosintelligence.com/2012/05/clamav-and-snort-coverage-for-flashback.html