Now: A virus from blogspot.gr comes with a Facebook message

A new virus is currently circulating at Facebook. It is hidden behind an address of hidemyass.com (an IP and domain hiding service) and leads to a website of blogspot.gr. The virus can not be said to come from a Greek blog as blogspot changes the ending of domains depending on the geographical location of the visitor. But with a better look, things change.

Below you can see the message that is trafficked through Facebook. (Our image sent her a friend from us safer-internet.gr)

If someone clicks on the “safe Youtube Video” που έρχεται με το μήνυμα του Facebook, οδηγείται στην παρακάτω διεύθυνση.

The page that opens represents Youtube but the video (classic) will not play unless you install “adobe flash player. ”

In the blog screenshot below you can see the Greek name used by the malicious user: Note the URL of the page. The title of the publication is brazil sugar (This page is displayed with Firefox)

If you use Firefox you need to download the file (video) that is actually a Windows executable (.exe) file.

If someone uses Chrome and opens the hidemyass URL, the executable file will be downloaded on its own.

See the page displayed in Chrome

The malicious file is downloaded with a different name each time, since the numbers it contains change each time. So the "Private_Video_23429.mp4.exe" next time it downloads changes to "Private_Video_xxxxx.mp4.exe."

What is happening with the virus now:

We uploaded the malicious file to jotti.org, The virustotal and VirSCAN. You can see the results and which antivirus they recognize.

Read more data about the virus and the files it injects into the infected system below:

PE sections

PE imports