Eltima Software's Elmedia Player and Folx Infected With Malware

[camelia]

I had to format my hard drive, but as soon I get new from Malwarebytes, I will post the results here

Do you know if Eltima support replies fast?
Because I will try to reach them also via email just like you did

Tc

I don't know, I send them an email but they never replied to it, they post at this thread only

Came

 

[Xray50]

Ok, it seems Malwarebytes for Mac detects all currently known forms of OSX.Proton including that found in Handbreak, Eltima software and the one found just this week, Symantec Malware Detector. It will display everything found and give you the opportunity to remove it.

https://forums.malwarebytes.com/topic/215713-osxproton/?do=findComment&comment=1186082

Symantec????

Here is more info:

https://blog.malwarebytes.com/cybercrime/2017/10/mac-malware-osx-proton-strikes-again/
https://securityboulevard.com/2017/11/osx-proton-spreading-through-fake-symantec-blog/

Tc

 

[petzl]

Since I already suspected Eltima of being some agency outlet, since their software portfolio seems too good and diverse to be true and with deep roots into the system and network level while regularly lacking the last bit of polish, I am not surprised.

So I guess they are just checking out Apple‘s internal procedures for further infiltration now.

Of course, if they‘re not the dark hats themselves, they are a perfect target due the same reasons...

But then their strange office address...

Ah, have to hide...

</tinfoil>

I'm not sure what it means, but you get a hit if you plug in their Nevis address in the Panama Papers database. (To those who aren't current with this, this involves the shady Panamanian bank Mossack-Fonseca that catered to shady people who want to hide their money, their financial transactions and their identities: google "panama papers")

https://offshoreleaks.icij.org/nodes/12191480

There's just something "off" and unintentionally inept about the company: calling itself Elmedia, yet the company is Eltima. The "El" makes us think its a Latino-directed product in some way, yet its obviously not. It's reminiscent of how many Chinese knockoffs have product (or company) names to mimic bona-fide products/companys: eg, SOMY or SONEY instead of SONY.

On Eltima's website, who is Olga Weis? And why is their download page staged to look like a blog post? It's just odd:

https://www.eltima.com/mkv-codec-alternative-mac.html