Zango and the fake Yootube Movies

gonzo · 11-08-2006

Websense® Security LabsTM has discovered a number of user pages on the MySpace domain which have videos that look like they are from You Tube. The videos have an installer embedded within them for the Zango Cash Toolbar. When users click on the video, they are directed to a copy of the video, which is hosted on a site called "Yootube.info."

Warning: This site has adult images on it.
The site has a "click here for the full video" button and redirects users to a Microsoft® Windows® media video that requests users accept the end-user licensing agreement in order to watch the video. Assuming that users have accepted the agreement, the video downloads and attempts to install setup.exe from Zango Cash.
This is similar to another incident in the past where videos were posted on MySpace. However, the You Tube domain was not fraudulent and the video was posted on VitalSecurity.org.
The fraudulent You Tube website is hosted in Amsterdam and was up and running at the time of this alert. The registration for the domain name is also clearly fraudulent.

Screenshot 1: Video posted on MySpace accounts:

Screenshot 2: Zango Cash License Agreement

Screenshot 3: Zango Cash installer launch attempt

source

Hammer · 11-08-2006

"Mo money, mo money, mo money."

- Lars

11-08-2006	#1
gonzo Fat Fucking Nobody Want to see your own Advertising Here! Join Date: Apr 2003 Location: Atlanta,Ga. Posts: 17,795 Blog Entries: 11	Zango and the fake Yootube Movies Websense® Security LabsTM has discovered a number of user pages on the MySpace domain which have videos that look like they are from You Tube. The videos have an installer embedded within them for the Zango Cash Toolbar. When users click on the video, they are directed to a copy of the video, which is hosted on a site called "Yootube.info." Warning: This site has adult images on it. The site has a "click here for the full video" button and redirects users to a Microsoft® Windows® media video that requests users accept the end-user licensing agreement in order to watch the video. Assuming that users have accepted the agreement, the video downloads and attempts to install setup.exe from Zango Cash. This is similar to another incident in the past where videos were posted on MySpace. However, the You Tube domain was not fraudulent and the video was posted on VitalSecurity.org. The fraudulent You Tube website is hosted in Amsterdam and was up and running at the time of this alert. The registration for the domain name is also clearly fraudulent. Screenshot 1: Video posted on MySpace accounts: Screenshot 2: Zango Cash License Agreement Screenshot 3: Zango Cash installer launch attempt source __________________ We are putting the bastards of this world on notice; greed and corruption will always be met with "a voice made of ink and rage." "Never try and be like anyone else" - Hunter S. Thompson "The truth is the truth no matter how you try and package a lie" - Shellee Hale

11-08-2006	#2
Hammer Master of My Domains Join Date: Apr 2003 Location: Florida Posts: 1,701	Re: Zango and the fake Yootube Movies "Mo money, mo money, mo money." - Lars __________________ Porn Site Pros - Custom Website Design, Turnkey Webcam and Pay Sites, SEO, and Consulting