Heads up: Malware found in Piriform’s CCleaner installer

Credit to Author: Woody Leonhard| Date: Mon, 18 Sep 2017 05:22:00 -0700

If you installed the free version of CCleaner after Aug. 15, a couple of nasty programs came along for the ride. Talos Intelligence, a division of Cisco, just published a damning account of malware that it found hiding in the installer for CCleaner 5.33, the version that was released on Aug. 15 and which, according to Talos, was still the primary download on the official CCleaner page on Sept. 11.

After notifying Piriform, CCleaner was, ahem, cleaned up and version 5.34 appeared on Sept. 12.

I just checked, and the current version available from Piriform is version 5.34. (Piriform was bought by antivirus giant Avast in July.)

Edmund Brumaghin, Ross Gibb, Warren Mercer, Matthew Molyett, and Craig Williams at Talos report:

Talos recently observed a case where the download servers used by software vendor to distribute a legitimate software package were leveraged to deliver malware to unsuspecting victims. For a period of time, the legitimate signed version of CCleaner 5.33 being distributed by Avast also contained a multi-stage malware payload that rode on top of the installation of CCleaner. …

Even though the downloaded installation executable was signed using a valid digital signature issued to Piriform, CCleaner was not the only application that came with the download. During the installation of CCleaner 5.33, the 32-bit CCleaner binary that was included also contained a malicious payload that featured a Domain Generation Algorithm (DGA) as well as hardcoded Command and Control (C2) functionality.

The details are complex, but the upshot is clear: Somebody managed to tack a malware package onto the legitimate distribution file for CCleaner. If you install CCleaner 5.33, your machine hooks into a bot network.

Talos published very convincing logs of attempts by infected machines to hook into the bot Command sites. The primary infection Command server has been taken offline, as has a secondary server.

According to Talos, the Virus Total regimen for checking antivirus products against a submitted sample turned up only one AV package that correctly identifies this infection, “Win.Trojan.Floxif-6336251-0.”

Antivirus packages will likely increase their detections in the next few hours, but it’s still concerning.

According to Reuters, Avast estimates that “2.27 million users had downloaded the August version of CCleaner.” It isn’t clear from the report if that’s the total number of downloads for CCleaner 5.33. Reuters goes on to quote Avast as saying the C2 server was closed down on Sept. 15 “before any known harm was done.”

We’ll be following up on AskWoody.com, as soon as the site comes back. Oy.

http://www.computerworld.com/category/security/index.rss