New malware spreading over Facebook, using fake Youtube portal

That trick was really about to get me...

The bot would realy make you believe it is your Facebook contact talking to you, but it is not...

I sent the URL to VirusTotal, here are the results: nothing to worry about...

https://www.virustotal.com/url-scan/report.html?id=57e229513f552a0ba3775213d1d6b8c6-1311622558#

Even the "downloaded file" analysis does not show any alert:

https://www.virustotal.com/file-scan/report.html?id=c91712143eefa0f98daec77036d6a22a2c1633556bfdbe895392ed8b559ad00a-1311630321

And the reason is quite simple... there is neither automatic file download, nor drive-by-download. Once again, the user will be lured to download himself the "latest Flash player version"...

Pretty well done, uh? But this is not youtube...

What I find pretty outstanding, is the fact that the "fake youtube" website did grab the Facebook victims's username, and furthermore, fake comments from the victim's contacts are also being displayed below the (fake) video!

Please note that the URL is a single IP address, no domain name! According to Netcraft, the server is being hosted in Bulgaria: http://toolbar.netcraft.com/site_report?url=http://213.231.133.56 

So, in order to view the video, the user is supposed to click on the link. I serves a Flash-Player.exe file, hosted on the same HTTP server.

And this time, the AV scans do tell us something interesting:

https://www.virustotal.com/file-scan/report.html?id=7a9578ad75913564178f1e5c5be2fade4abb20835ff9ec82eb0716ce7a151c7d-1311629984#

Unfortunately, the URL itself does not trigger so many security systems:

- Internet Explorer (with Trend Micro Browser Guard): no alert

- Firefox 5: no alert

- Chrome 12.0.742: no alert 

- Safari 5: no alert.

- Webreputation: "domain not reachable"... 

In fact, most of these results are summarized within the VT's "URL analysis tool" report.

While investigating the threat, I noticed they apparently use a stealth system: you can't request access to the domain several times, even using different browsers, of you're gonna be blocked.

This works over HTTP, while the ping (ICMP) still responds.