This version was signed using a valid certificate that was issued to Piriform Ltd by Symantec and is valid through. The version containing the malicious payload (5.33) was being distributed between these dates. In reviewing the Version History page on the CCleaner download site, it appears that the affected version (5.33) was released on August 15, 2017. We confirmed that this malicious version of CCleaner was being hosted directly on CCleaner’s download server as recently as September 11, 2017. During the installation of CCleaner 5.33, the 32-bit CCleaner binary that was included also contained a malicious payload that featured a Domain Generation Algorithm (DGA) as well as hardcoded Command and Control (C2) functionality. We identified that even though the downloaded installation executable was signed using a valid digital signature issued to Piriform, CCleaner was not the only application that came with the download. Talos began initial analysis to determine what was causing this technology to flag CCleaner. Upon closer inspection, the executable in question was the installer for CCleaner v5.33, which was being delivered to endpoints by the legitimate CCleaner download servers. On Septemwhile conducting customer beta testing of our new exploit detection technology, Cisco Talos identified a specific executable which was triggering our advanced malware protection systems.
#Ccleaner malware download upgrade#
The company is urging users to upgrade to version 5.34 or higher (which it says is available for download here).
The affected versions of the software are CCleaner and CCleaner Cloud. The security team at Cisco Talos discovered that download servers used by CCleaners had been compromised to distribute malware inside CCleaner.
0 kommentar(er)
