Monday, November 25, 2024
HomeData BreachCCleaner Got Hacked & Used For Distributing Malware that Infected ...

CCleaner Got Hacked & Used For Distributing Malware that Infected 2 Million Users

Published on

A Most Famous Sofware  CCleaner Hacked and Distributing Floxif Malware from Download server of Leading Anti-Virus Vendor AVAST and more than 2 million Users Infected by this Malware.

CCleaner is a subsidy of AVAST that released legitimate signed version of CCleaner 5.33 with a Malicious payload that rode on top of the installation of CCleaner.

CCleaner is an application that allows users to perform routine maintenance on their systems. It includes functionality such as cleaning of temporary files, analyzing the system to determine ways in which performance can be optimized and provides a more streamlined way to manage installed applications.

CCleaner Estimated Downloads around 2 Billion by November of 2016  that meant to be one of the most Widely  Downloaded Software lists.

Also Read   Vevo Got Hacked by OurMine After Employee Questioned their Abilities

How Does CCleaner Hacked and Infect the Malware

A New exploit detection technology used by Cisco that conducted a Beta Test for their Customer that revealed a New Executable being Served in this Process.

- Advertisement - SIEM as a Service

Cisco Talos Identified by further Analysis that the executable in question was the installer for CCleaner v5.33, which was being delivered to endpoints by the legitimate CCleaner download servers.

CCleaner Hacked
According to Cisco Talos, even though the downloaded installation executable was signed using a valid digital signature issued to Piriform, CCleaner was not the only application that came with the download.

This Malware included the 32 bit Binary has featured a Domain Generation Algorithm (DGA) as well as hardcoded Command and Control (C2) functionality During the installation of CCleaner 5.33.

Later, Floxif Malware gathers information such as computer name, a list of installed software, a list of running processes, MAC addresses for the first three network interfaces, and unique IDs infected systems and sends it back to its C&C server.

This version was signed using a valid certificate that was issued to Piriform Ltd by Symantec and is valid through 10/10/2018.

Malware Operation Performs 32-bit CCleaner v5.33 binary included with the legitimate CCleaner v5.33 installer, to call to the code.

CCleaner Hacked

Malware Operation FLow

“This was done to redirect code execution flow within the CCleaner binary to the malicious code prior to continuing with the normal CCleaner operations. The code that is called is responsible for decrypting data which contains the two stages of the malicious payload, a PIC (Position Independent Code) PE loader as well as a DLL file that effectively functions as the malware payload.”

This Help to Attacker to Evade the Detection from the malicious DLL that is being Executed.

If the user executing the malware does have administrative privileges on the infected system, SeDebugPrivilege is enabled for the process and Once the aforementioned activities have been performed, the malware then begins profiling the system and gathering system information which is later transmitted to the C2 server. Cisco Said.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting...

Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials

The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ...

XSS Vulnerability in Bing.com Let Attackers Send Crafted Malicious Requests

A significant XSS vulnerability was recently uncovered in Microsoft’s Bing.com, potentially allowing attackers to...

Meta Removed 2 Million Account Linked to Malicious Activities

 Meta has announced the removal of over 2 million accounts connected to malicious activities,...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting...

Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials

The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ...

Massive Credit Card Leak, Database of 1,221,551 Cards Circulating on Dark Web

A massive data breach has sent shockwaves across the globe, as a database containing...