lmkash.blogg.se

It turns out to be a 32-bit executable of CCleaner version 5.33, digitally signed on, e.g. Only one executable detected by our ccleaner_compromised_pdb rule was not infected: an executable with SHA256 hash c48b9db429e5f0284481b4611bb5b69fb6d5f9ce0d23dcc4e4bf63d97b883fb2. Most of these files did not have a (valid) signature: they were modified versions, e.g. We saw examples of portable application packages distributing this compromised version of CCleaner (like LiberKey) and also RAR files with pirated versions of CCleaner.Ģ3 files were actual executables, and were all compromised versions of the 32-bit executable of CCleaner version 5.33, except one. Most of these are actually container files (like ZIP files): CCleaner is a popular application, and is distributed through various channels other than Piriform’s website. With this rule, we were able to identify 235 files on VirusTotal. This string is the full path of the Program Database (PDB) file, a debug file created by default by Visual Studio and referenced in compiled executables. The first 2 rules we created are hash based, but the third rule (ccleaner_compromised_pdb) is based on a particular string found in CCleaner’s 32-bit executables. You can scan the C: drive of a computer with YARA like this:Īnd there are also many other scanning tools that include the YARA engine, like ClamAV. $b = 's:\\workspace\\ccleaner\\branches\\v5.33\\bin\\CCleaner\\ReleaseTV\\CCleaner.pdb' $a = 's:\\workspace\\ccleaner\\branches\\v5.33\\bin\\CCleaner\\Release\\CCleaner.pdb' First reported by Talos and Morphisec, the compromise of CCleaner version 5.33 is still making news.Īt NVISO Labs, we created YARA detection rules as soon as the news broke, and distributed these rules to our clients subscribed to our NVISO Security Advisories.