Poisoned CCleaner search results spread information-stealing malware

[LASER_oneXM]

Content source

https://www.bleepingcomputer.com/news/security/poisoned-ccleaner-search-results-spread-information-stealing-malware/

Malware that steals your passwords, credit cards, and crypto wallets is being promoted through search results for a pirated copy of the CCleaner Pro Windows optimization program.

This new malware distribution campaign is dubbed “FakeCrack,” and was discovered by analysts at Avast, who report detecting an average of 10,000 infection attempts every day from its customer telemetry data. Most of these victims are based in France, Brazil, Indonesia, and India.

The malware distributed in this campaign is a powerful information stealer that can harvest personal data and cryptocurrency assets and route internet traffic through data-snatching proxies.

A Black Hat SEO campaign​

The threat actors follow Black Hat SEO techniques to rank their malware-distribution websites high in Google Search results so that more people will be tricked into downloading laced executables.
The lure seen by Avast is a cracked version of CCleaner Professional, a popular Windows system cleaner and performance optimizer that is still considered a “must-have” utility by many users.

 

[Gandalf_The_Grey]

search results for a pirated copy

 

[upnorth]

search results for a pirated copy

Very common old practice and also highly effective.

New SEO Poisoning Campaign Distributing Trojanized Versions of Popular Software

A new SEO poisoning campaign is distributing trojanized versions of popular software utilities.

thehackernews.com

SEO Poisoning Used to Distribute Ransomware

This tactic — used to distribute REvil ransomware and the SolarMarker backdoor — is part of a broader increase in such attacks in recent months, researchers say.

www.darkreading.com

 

[ScandinavianFish]

There is an reason illegal software are the most common way private induvidials get infected nowadays, simply because almost everyone at one point uses such software.

 

[vuksha_xc60]

The lure seen by Avast is a cracked version of CCleaner Professional, a popular Windows system cleaner and performance optimizer that is still considered a “must-have” utility by many users.

I don't really know who on the Earth could claim that CCleaner is a must have utility these days after all the incidents related to it happened in the past.

 

[SeriousHoax]

Anyone who searches for a pirated Ccleaner deserves to get infected, maybe. I know all of these sites and submitted to quite a few vendors. But some, including Avast don't block most of the sites you see in the screenshots even at this moment. Most of these sites themselves don't contain malware, but IMO it's important to block them all to stop the main source. AVs that block almost all are ESET, Kaspersky, Malwarebytes, probably F-Secure unsureand maybe a few others.

 

[ScandinavianFish]

Anyone who searches for a pirated Ccleaner deserves to get infected, maybe. I know all of these sites and submitted to quite a few vendors. But some, including Avast don't block most of the sites you see in the screenshots even at this moment. Most of these sites themselves don't contain malware, but IMO it's important to block them all to stop the main source. AVs that block almost all are ESET, Kaspersky, Malwarebytes, probably F-Secure unsureand maybe a few others.

Many of these sites are "legit", its just they contain "download here" ad buttons and site redirects that are the ones spreading malware, so in the eyes of AV vendors they sit in kinda of an grey zone and may or may not be completely blocked.

 

[SeriousHoax]

Many of these sites are "legit", its just they contain "download here" ad buttons and site redirects that are the ones spreading malware, so in the eyes of AV vendors they sit in kinda of an grey zone and may or may not be completely blocked.

As I said, "IMO it's important to block them all to stop the main source."

 

[Kongo]

Just found one of the "CCleaner Installers":

File size is above 600mb so that the antivirus and antimalware solution can't scan the executable file. Most AVs have a file size limit for scanning, so thats the attackers way to evade detection. It was even too big to upload to VirusTotal or Intenzer Analyze.

After checking out the file in HexEdit I saw that a big part of the executable just consists of data with no function, which is the reason why the file is so big.

Junk Data:


Actual malicious part:



After deleting the junk part, the file size was just a few KB and ready to upload to VirusTotal.

VirusTotal result:


So always be cautious with big exe-files from untrusted sources.

 

[Thales]

I don't use pirated software, so I'm fine.

 

[Digmor Crusher]

I don't use pirated software, so I'm fine.

Me neither.

 

[robert-smith]

instead of spending time with the pirate software I prefer useing giveaway versions. they're %1000gb trustful and the lisences come from their own venders.
aditionally, I use cCleaner portable on my pc as well with my own personalised settings, that's actually enough for me. even if it promises to save the whole universe with the pro features I don't care. I already run it once per week, maybe a century.

 

[JB007]

Me neither.

Me too !

 

[Kongo]

And I am not using CCleaner nor any cracks

 

[Sorrento]

I like CCleaner & renew sub each year albeit at a reduced cost usually