The gang distributing FakeAv downloaders and more have moved their goods and scheme to yet another server and adult theme. In addition to downloader filenames like streamviewer.45043.exe, tubeviewer.ver.6.21586.exe, onlinemovies.45023.exe, the group is finding success in their new addition, freepornmovies.40067.exe. The ThreatFire community is protected from these downloaders, and the newest is showing up in higher volumes.
For the most part, this downloader is being served from 188.8.131.52. The following domains currently resolve to that address:
The downloader itself currently is pulling down embedded, encrypted malicious files, described in a previous post, from
Be wary of codecs that may be tempting to download and run.