Fake SourceForge Site Distributes Malware

Malicious files were hosted on a fake SourceForge clone (http://sourceforgechile.net), including a sample named minecraft_1.3.2.exe. The sample is linked to the ZeroAccess trojan family and exhibits persistence (installs as a Windows service, hides in the Recycle Bin), code injection, opens/listens on a port, and connects to roughly 20 IPs on port 16471 to perform click-fraud and operate as part of a botnet; a VirusTotal report is provided. Users are advised to obtain files only from the official SourceForge site.