Only the 32-bit executable of CCleaner is compromised. The shortcuts (like Start and Desktop shortcuts) deployed during the install on Windows 64-bit machines will point to the 64-bit executable, hence normal usage on a Windows 64-bit machine will execute 64-bit CCleaner. Our analysis shows that the compromised CCleaner installer (version 5.33) will install 32-bit and 64-bit versions of the CCleaner executables on a Windows 64-bit machine, and only the 32-bit version on a Windows 32-bit machine. Our rules allow you to detect compromised CCleaner executables in your environment, but this does not imply that the machines identified by these rules were infected. Yesterday (), Piriform finally released a new version (5.35) signed with a new digital certificate obtained yesterday.Īt this moment, we are uncertain about the origins and purpose of this particular executable ( c48b9db429e5f0284481b4611bb5b69fb6d5f9ce0d23dcc4e4bf63d97b883fb2). This executable was signed with the same certificate that was used for the compromised version 5.33 (thumbprint f4bda9efa31ef4a8fa3b6bb0be13862d7b8ed9b0), and also for follow-up version 5.34. The build number was increased with one (6163 instead of 6162). It turns out to be a 32-bit executable of CCleaner version 5.33, digitally signed on, e.g. Only one executable detected by our ccleaner_compromised_pdb rule was not infected: an executable with SHA256 hash c48b9db429e5f0284481b4611bb5b69fb6d5f9ce0d23dcc4e4bf63d97b883fb2. Most of these files did not have a (valid) signature: they were modified versions, e.g. We saw examples of portable application packages distributing this compromised version of CCleaner (like LiberKey) and also RAR files with pirated versions of CCleaner.Ģ3 files were actual executables, and were all compromised versions of the 32-bit executable of CCleaner version 5.33, except one. ![]() Most of these are actually container files (like ZIP files): CCleaner is a popular application, and is distributed through various channels other than Piriform’s website. With this rule, we were able to identify 235 files on VirusTotal. This string is the full path of the Program Database (PDB) file, a debug file created by default by Visual Studio and referenced in compiled executables. ![]() The first 2 rules we created are hash based, but the third rule (ccleaner_compromised_pdb) is based on a particular string found in CCleaner’s 32-bit executables. You can scan the C: drive of a computer with YARA like this:Īnd there are also many other scanning tools that include the YARA engine, like ClamAV. $b = 's:\\workspace\\ccleaner\\branches\\v5.33\\bin\\CCleaner\\ReleaseTV\\CCleaner.pdb' ![]() $a = 's:\\workspace\\ccleaner\\branches\\v5.33\\bin\\CCleaner\\Release\\CCleaner.pdb' ![]() First reported by Talos and Morphisec, the compromise of CCleaner version 5.33 is still making news.Īt NVISO Labs, we created YARA detection rules as soon as the news broke, and distributed these rules to our clients subscribed to our NVISO Security Advisories.
0 Comments
Leave a Reply. |