Fake Porntube Malware

I came across yet another fake PornTube site.

The Whois for that domain is somewhat obscure!

The malicious file comes from another domain (eshymkent.cn), yet on the same IP

The malware file turns out to be a rogue app called Fast Antivirus 2009

Although this rogue is already known, I am surprised to see the low detection rate on VirusTotal:

Jerome Segura

Malware ID: d33e766d7fc6a984fe797816cc4af245.zip