Ccleaner malware high level code#

Subsequently, the address of the CnC server can also be arbitrarily modified in the future by sending a special command, recognized by the code as a signal to use the DNS protocol (udp/53) to get address of the new server,” Avast’s CEO and CTO explained. “Much of the logic is related to the finding of, and connecting to, a yet another CnC server, whose address can be determined using three different mechanisms: 1) an account on GitHub, 2) an account on WordPress, and 3) a DNS record of a domain (name modified here).

The second stage payload uses two components (DLLs): the first component contains the main business logic, and the second part of the payload is responsible for persistence. They posit that the actual number of computers that received the second stage payload “was likely at least in the order of hundreds.” But, as they noted, the number of compromised hosts and companies is likely higher, as the list was probably changed over the month or so the server was active.Īvast also arrived to the same conclusion. They also identified 20 unique hosts at eight (unnamed) companies that received the second stage payload that followed the CCleaner backdoor compromise. Of these some 540 are government systems around the world, and 51 belong to domains containing the word “bank” in their name.

Ccleaner malware high level archive#

A stealthy, targeted attackĪccording to Cisco, their actual targets were computers at a number of huge tech companies like Intel, Microsoft, Linksys, Dlink, Google, Samsung and Cisco, telecoms such as O2 and Vodafone, and (the odd man out) Gauselmann, a manufacturer of gaming machines.Ĭisco researchers came to this conclusion after analyzing an archive containing files that were stored on the attackers’ C&C server, and finding the list of domains the attackers were attempting to target:Īccording to their findings, some 700,000 hosts were saddled with the backdoored CCleaner. 'When combined, this information would be everything an attacker would need to launch a later stage payload that the attacker could verify to be undetectable and stable on a given system.There is a new twist in the CCleaner hack saga: the attackers apparently didn’t set out to compromise as many machines as possible, but were after some very specific targets. 'It's quite likely this information was used by the attackers to determine which machines they should target during the final stages of the campaign,' they added. 'These new findings raise our level of concern about these events, as elements of our research point towards a possible unknown, sophisticated actor,' the researchers wrote.ĭuring the compromise, the malware would 'periodically contact' the attackers' command and control server and 'transmit reconnaissance information about infected systems' including IP addresses, online times, hostnames, domain names, process listings, and more, the researchers wrote.

Talos researchers have reached out to the affected companies and alerted them of a possible compromise.

Ccleaner malware high level software#

'This would suggest a very focused actor after valuable intellectual property,' Cisco researchers wrote.īesides Cisco, the list of targeted companies includes Google, Intel, Microsoft, Samsung, Sony, HTC, and Linksys, as well as Dell-owned cloud computing software firm VMware, cloud services provider Akamai, British telecom company Vodafone, Taiwanese networking equipment maker D-Link, and Singapore-based mobile network operator Singtel.

Best Malware Removal and Protection Software.