Received another malicious emails with download link to this domain: http://www.ge.tt/api/1/files/1PH3Ays1/0/blob?download The malware analisys is this: https://www.virustotal.com/es-ar/file/f836f66e535f00e44dfb9ca06ea417e19da84ed034bc87786c135b6396f17565/analysis/ Recived malicious emails with links poiting this web to dowload malware. Links like: http://ge.tt/api/1/files/9PTd31w/0/blob?Anexo.Deposito2013

this is a file host like mediafire, mega, dropbox, and rapidshare. do not trust any software downloads unless you are specifically seeking software. if the website or message linking to ge,tt seems like it is written like an advertisement with fishy promises, do not trust the software.

GREEN IS THE WRONG SIGNAL! Provider has no virus scanner on upload files, it is your risk what you get! 2014-06-03: Virus downloader on /api/1/files/7y61ooi1/0/blob?download 2014-05-29: Virus downloader on /api/1/files/39sja8i1/0/blob?download 2014-02-04: Spamvertised virus downloader 2013-05-21: Spamvertized link to /api/1/files/(removed)/0/blob?download detected 2013-02-24: Spamvertized link to /api/1/files/9hnBYIZ/0/blob?download detected 2013-02-13: Spamvertized link to virus on /api/1/files/(removed)/0/blob detected

Amazons servers are regularly used to serve malware, phishing scams and used as port scanners by hackers/criminals etc who are looking for site vulnerabilities. This has resulted in all amazons servers being fire walled for our basic protection, they simply became too big a risk.

*updated at 2013, Sep 23 ***WARNING*** - MALWARES found in this website at [ge.tt/api/1/files/FILENAME/0/blob?download?camila@jomatic.com.br] which FILENAME = 77xz5Ws [ge.tt/api/1/files/FILENAME/0/blob?download?compras@pinokio.com.br] which FILENAME = 2oxGujs and automatically download a suspicious zip files infected with WORM - see more informations at https://www.virustotal.com/file/1738e2094588cd806c70c0d96e32209fc4f07760bb8e9b4dfc8567776cf55a48/analysis/1379572795/ and https://www.virustotal.com/file/eb627e881132297a3cd7ef0ecb307d337b4b222c201184f7534babcf59bccc47/analysis/1379944551/ ***NEVER TRUST ANY HYPERLINKS CONTAINED IN SPAMS*** ------------------------------------ *atualizado em 23 de setembro de 2013 ***ATENÇÃO*** - MALWARES encontrados neste site em [ge.tt/api/1/files/NOME/0/blob?download?camila@jomatic.com.br] onde NOME = 77xz5Ws [ge.tt/api/1/files/NOME/0/blob?download?compras@pinokio.com.br] onde NOME = 2oxGujs e são baixados automaticamente arquivos zip contaminados com WORM - veja mais informações sobre o assunto em https://www.virustotal.com/pt/file/1738e2094588cd806c70c0d96e32209fc4f07760bb8e9b4dfc8567776cf55a48/analysis/1379572795/ e também em https://www.virustotal.com/pt/file/eb627e881132297a3cd7ef0ecb307d337b4b222c201184f7534babcf59bccc47/analysis/1379944551/ ***JAMAIS CONFIE EM LINKS CONTIDOS EM SPAMS***

Got a spam mail with following content: "Find attached invoice as per our conversation. CLICK TO VIEW INVOICE [http://ge.tt/api/1/files/8gswllo/0/blob?down~load] Blocked image [http://ge.tt/api/1/files/6X0oklo/0/blob?down~load] Thanks. Hassan Wasir " Fake contact, sent to "undisclosed recipients"