{"id":2918,"date":"2014-11-14T11:13:54","date_gmt":"2014-11-14T11:13:54","guid":{"rendered":"http:\/\/www.freefixer.com\/b\/?p=2918"},"modified":"2018-05-29T12:01:51","modified_gmt":"2018-05-29T12:01:51","slug":"svan-trans-llc-25-detection-rate","status":"publish","type":"post","link":"https:\/\/www.freefixer.com\/b\/svan-trans-llc-25-detection-rate\/","title":{"rendered":"SVAN TRANS LLC – 25% Detection Rate"},"content":{"rendered":"

Hi there! Just wanted to give you the heads-up on suspicious file I found right now before having my lunch. The file is named FlashPlayer__6741_i1404957756_il13.exe and digitally signed by SVAN TRANS LLC<\/strong>.<\/p>\n

\"SVAN<\/a><\/p>\n

You can also see the SVAN TRANS LLC certificate by looking under the Digital Signature tab on the file’s properties. According to the certificate, SVAN TRANS LLC is located in Kiev, Ukraine.<\/p>\n

\"SVAN<\/a><\/p>\n

The issue is that FlashPlayer__6741_i1404957756_il13.exe is not an official Flash Player<\/strong> download. If it was, it would be digitally signed by Adobe Systems Incorporated<\/strong>, and not by some unknown company from Ukraine.<\/p>\n

25% of the scanners detected the file. The FlashPlayer__6741_i1404957756_il13.exe file is detected as PUA.Amonetize!<\/strong> by Agnitum, Gen:Variant.Application.Jaik<\/strong> by F-Secure and PUP.Optional.Amonetize<\/strong> by Malwarebytes. Thanks to VirusTotal<\/a> for the scan report.<\/p>\n

\"svan<\/a><\/p>\n

Since some of the anti-virus programs detected the SVAN TRANS LLC file, I got curious and decided to test it to see what it installed. After stepping though the installer, Salus Net Protector<\/a>, RocketTab<\/a> and My Start Search were disclosed.<\/p>\n

\"SVAN<\/a> \"SVAN<\/a><\/p>\n

Did you also find an SVAN TRANS LLC? Do you remember the download link? Please post it in the comments below and I’ll upload it to VirusTotal to see if that one is also detected.<\/p>\n

Thanks for reading.<\/p>\n","protected":false},"excerpt":{"rendered":"

Hi there! Just wanted to give you the heads-up on suspicious file I found right now before having my lunch. The file is named FlashPlayer__6741_i1404957756_il13.exe and digitally signed by SVAN TRANS LLC. You can also see the SVAN TRANS LLC certificate by looking under the Digital Signature tab on the file’s properties. According to the … Continue reading SVAN TRANS LLC – 25% Detection Rate<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[54],"tags":[126,186,218],"_links":{"self":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/2918"}],"collection":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/comments?post=2918"}],"version-history":[{"count":1,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/2918\/revisions"}],"predecessor-version":[{"id":2924,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/2918\/revisions\/2924"}],"wp:attachment":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/media?parent=2918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/categories?post=2918"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/tags?post=2918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}