Malicious Loader in CCleaner and CCleaner Cloud by Avast Exposes Users to Data Theft

CVE-2017-20201

What is CVE-2017-20201?

A vulnerability in CCleaner v5.33.6162 and CCleaner Cloud v1.07.3191 involved a pre-entry-point loader that redirected program execution, allowing the injection of malicious code. This code decoded an embedded payload and executed it in memory, enabling remote data collection and potential lateral movement within networks. Analysis reveals that the payload was designed to evade detection through various anti-analysis checks and attempted to exfiltrate sensitive user data to predefined command and control servers via HTTPS. The affected versions were swiftly remediated with subsequent releases, addressing the security flaws present.

References