BitRoad.net

[sowhat-x]

...wanted to download an e-book today,and the original poster,
instead of using the pretty much widely known Rapidshare/MediaFire services,
he/she had chosen to upload it via a file-storage service called "BitRoad.net":
hxxp://bitroad.net/index.php

Now,these BitRoad guys require from the end-users to install a firefox extension,
in order to continue to the direct download link...yeah,sure...
At the time being,direct link to the ff extension is:
hxxp://files.firebit.net/files/firebit_26266.xpi

Firefox's .xpi extensions are nothing more than .zip archives,
so simply rename the above accordingly and extract it...it contains a firebit.dll,
currently detected as AdWare.Kitsune,with a result of 13/32 (40.63%) over at VirusTotal.
What I found somewhat funny/interesting about it,was the castlecops.com string in it... 

[sowhat-x]

From the same guys...
they seem to maintain another similar online file-storage service:
hxxp://friendlyfiles.net

No Firefox extension/support this time though...
they explicity ask the end-user to use Internet Explorer instead,
and then install the following nsis executable..."ADSTechnologyInstall.exe":
hxxp://friendlyfiles.net/install.php?pin=20140&submit=DOWNLOAD

Most AVs call it AdWare.ADSTechno or so,
not exactly the greatest detection rates at the moment though...

[MysteryFCM]

Surprise surprise;

Code: [Select]

Domain Name: FRIENDLYFILES.NET
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com
Name Server: NS5.PUBLIC-NS.COM
Name Server: NS6.PUBLIC-NS.COM
Status: ok
Updated Date: 12-oct-2007
Creation Date: 31-jul-2007
Expiration Date: 31-jul-2009


[MysteryFCM]

Code: [Select]

Domain Name: FIREBIT.NET
Registrar: ESTDOMAINS, INC.
Whois Server: whois.estdomains.com
Referral URL: http://www.estdomains.com
Name Server: MANAGEDNS1.ESTBOXES.COM
Name Server: MANAGEDNS2.ESTBOXES.COM
Name Server: MANAGEDNS3.ESTBOXES.COM
Name Server: MANAGEDNS4.ESTBOXES.COM
Status: ok
Updated Date: 08-mar-2008
Creation Date: 08-jan-2008
Expiration Date: 08-jan-2009


[MysteryFCM]

Also on the same IP as files.firebit.net;

installs.ads-technology.net
installs.bitacc.com
installs.rupass.com