Live Global Events: Secure, Simplify, and Transform Your Business.

Zscaler Blog

Get the latest Zscaler blog updates in your inbox

Security Research

Fake SourceForge Site Distributes Malware

April 17, 2013 - 2 min read
We spotted malware hosted on hxxp:// a couple of days ago. The website is not currently responding, but appears to been set up as a fake and malicious version of the popular open-source hosting site SourceForge. was registered on 04/05/213 in the US and is hosted in the Ukraine.

One of the malicious files downloaded was hxxp:// Minecraft is a proprietary game with a significant following. Many open-source projects related to the game are hosted on SourceForge.

This file is a pretty nasty piece of malware:
  • It hides itself in the Recycle Bin
  • It disguises dropped files with names like Desktop.ini
  • It registers itself as a Windows service
  • It injects code in other threads and DLLs
  • It opens and listens to a port
  • It connects to about 20 IPs over port 16471
  • etc.
This malware is related to the ZeroAccess trojan. The malware makes money by clicking on ads (click fraud) and using the infected PC as part of a wider botnet (zombie PC).

You can get the VirusTotal report here. The detection rate among AV vendors has gone up in the past week, it is now flagged by most vendors.

As usual, be very careful about the files you download and run. In this case, ensure that you're downloading content from the official SourceForge site, not a clone.
form submtited
Thank you for reading

Was this post useful?

Explore more Zscaler blogs

A cyber criminal shopping for malware
Agniane Stealer: Dark Web’s Crypto Threat
Read Post
Business people walking through a city
The Impact of the SEC’s New Cybersecurity Policies
Read Post
Digital cloud illuminated in blue
Security Advisory: Remote Code Execution Vulnerability (CVE-2023-3519)
Read Post
The TOITOIN Trojan: Analyzing a New Multi-Stage Attack Targeting LATAM Region
Read Post
01 / 02
dots pattern

Get the latest Zscaler blog updates in your inbox

By submitting the form, you are agreeing to our privacy policy.