Rogueware buys you BMWs

As I was investigating some fake codec sites, late on a Friday night, I stumbled upon this one:

The malware is hosted on downloadxxtube.com. Interestingly enough, the page is totally open for the curious like me. You can see an “exe” folder where that file is hosted, but the thing that first caught my attention was those BMW pics…

Is that what online criminals dream of?

Don’t get me wrong, I think BMWs are splendid cars and if I had the budget I would be more than tempted!

The domain registratio info below. Created mid-July.

File detection on VirusTotal:

There is another domain hosting the same payload on that IP (78.159.98.70): showmeall-tube-xx.com

Ah… a sports car. Maybe some day…

Jerome Segura