The Latest in IT Security

More Fake SourceForge Websites Show Up

01
May
2013

Two weeks ago we reported on a fake SourceForge website, sourceforgechile.net, which was used to distribute malware. We have since seen more of these fake sites this past week:

  • sourceforgeestonia.net, registered on 04/26/2013
  • sourceforgegrenada.net, registered on 04/26/2013
  • sourceforgepalau.net, registered on 04/22/2013
  • sourceforgeecuador.net, registered on 04/21/2013
  • sourceforgeindiana.net, registered on 04/20/2013
  • sourceforgemorocco.net,  registered on 04/19/2013
  • sourceforgemyanmar.net ,  registered on 04/19/2013
  • sourceforgeyemen.net, registered on 04/06/2013

Each domain has been registered with different WHOIS information, but with the same registrar. All of them are unreachable today (DNS does not resolve).

We were however able to obtain two malicious files found from the these websites before they went dark:

  • http://sourceforgeestonia.net/minecraft_xray_texture_pack.exe
  • http://sourceforgeecuador.net/airport_firefighter_simulator.exe

The files are very similar to the malicious files from sourceforgechile.net which we analyzed earlier. They drop and hide malicious binaries into the Recycle Bin and are detected as the ZeroAccess Trojan.

It looks like the attacker is still registering new fake SourceForge websites. I’ll update this post with new domain that I uncover going forward.

Leave a reply


Categories

THURSDAY, MARCH 28, 2024
WHITE PAPERS

Mission-Critical Broadband – Why Governments Should Partner with Commercial Operators:
Many governments embrace mobile network operator (MNO) networks as ...

ARA at Scale: How to Choose a Solution That Grows With Your Needs:
Application release automation (ARA) tools enable best practices in...

The Multi-Model Database:
Part of the “new normal” where data and cloud applications are ...

Featured

Archives

Latest Comments