MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI

Description               

• Lavasoft is an adaware provider, but the application for web companion has suspicious downloads and other practices. The download is usually a default download or bundled in with other 3rd party applications. During the download, the application will request full permissions with browsers. This allows the application to change the default, new tab, and other settings to Bing, Yahoo, and other search engines. There are other reports of Lavasoft stealing data to sell to 3rd parties. It is recommended to uninstall the Web Companion as soon as possible and replace it with a more reputable AV.

Vector

• Port 443 SSL

User-Agent

• N/A

Known False Positive Indicators

• N/A

Affected Host

• Windows/ Mac

Classification

• Malware/ Adware/ PUA

Sentinel Signature

• MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI

DNS Calls

• N/A