More Fake SourceForge Websites Show Up

Multiple fake SourceForge websites (examples: sourceforgeestonia.net, sourceforgeecuador.net and others) were observed distributing malicious executables — two files (minecraft_xray_texture_pack.exe and airport_firefighter_simulator.exe) were recovered before the sites went dark. The samples are similar to earlier malicious files from sourceforgechile.net, are detected as the ZeroAccess Trojan, and drop/hide binaries in the Recycle Bin; several additional fake domains registered with the same registrar were enumerated.