A fake CCleaner installer is being used to deliver the GhostDesk Chrome extension, which steals credentials, cookies, screenshots, and keystrokes from Windows users. The campaign also uses lookalike fake apps such as 7-Zip and Adobe Acrobat, all connecting to the same command-and-control infrastructure to spread the spyware payload. #CCleaner #GhostDesk #Chrome #DuckDNS
Keypoints
- The campaign uses a counterfeit CCleaner download site, ccleanerwind[.]top, to distribute a malicious Windows installer.
- The fake installer launches CScript-based multi-stage infection logic that sets up persistence, reconnaissance, and browser modification.
- The malware patches Chrome’s Security Extension to load GhostDesk components, namely background.js and content.js.
- GhostDesk performs keylogging, form-data harvesting, cookie theft, screenshot capture, and arbitrary script execution inside the browser.
- The infection chain establishes command-and-control communication through liderongrade.duckdns[.]org and also uses a local WebSocket relay.
- Several other fake applications, including fake 7-Zip and fake Adobe Acrobat installers, use the same delivery approach and C2 infrastructure.
- One additional Adobe Acrobat sample was found using wscript.exe instead of cscript.exe, showing variation in the loader stage.
MITRE Techniques
- [T1189 ] Drive-by Compromise – Users are lured to a convincing fake download site that serves the malicious installer (‘a website designed to imitate the official CCleaner.com home page’).
- [T1036 ] Masquerading – The malware disguises itself as legitimate software by using the CCleaner name, icon, and fake version details (‘uses the same icon and filename as the legitimate CCleaner application’).
- [T1059.005 ] Command and Scripting Interpreter: Visual Basic – CScript is used to execute the infection chain (‘drops a legitimate instance of CScript (cscript.exe), then uses it to launch a series of scripts’).
- [T1082 ] System Information Discovery – The scripts query machine details such as GUID, name, and languages (‘Queries the registry for the machine GUID, name, and supported languages’).
- [T1546.011 ] Event Triggered Execution: Application Shimming – The malware replaces Runtime Broker with a reflexive loader to enable further execution (‘Writes to %AppData%MicrosoftDriverStoreruntimebroker.dll, replacing it with a reflexive loader’).
- [T1179 ] Hooking – Chrome Security Extension files are patched to alter browser behavior (‘Patches the Chrome Security Extension’s manifest.json to include a service worker and content script’).
- [T1105 ] Ingress Tool Transfer – Malicious JavaScript files are dropped into the local cse folder for later use (‘These JavaScript files are then dropped in the %LocalAppData%cse folder’).
- [T1071.001 ] Application Layer Protocol: Web Protocols – The malware uses WebSocket connections for C2 and relay communication (‘Creates a local WebSocket endpoint … and upgrades this endpoint to connect to … liderongrade.duckdns[.]org:4444’).
- [T1078 ] Valid Accounts – Browser cookies are collected for potential unauthorized access (‘uses chrome.cookies.getAll to grab the user’s browser cookies’).
- [T1113 ] Screen Capture – The extension captures screenshots of the active browser tab (‘sends a screenshot of the active browser tab to the WebSocket relay’).
- [T1059.007 ] Command and Scripting Interpreter: JavaScript – Malicious JavaScript runs as extension code and is also injected into webpages (‘content.js’, ‘background.js’, and ‘injectJS … execute arbitrary JavaScript code’).
- [T1056.001 ] Keylogging – Keystrokes entered into input fields are recorded and exfiltrated (‘Records keystrokes entered into input fields’).
- [T1056.002 ] GUI Input Capture: GUI Input Capture – Form submissions and POST requests are intercepted to steal entered data (‘listens for outgoing POST requests and submit events’).
- [T1106 ] Native API – The extension uses browser APIs to collect cookies and inject code (‘uses chrome.cookies.getAll’ and ‘chrome.scripting.executeScript’).
Indicators of Compromise
- [Domain] fake CCleaner site / C2 infrastructure – ccleanerwind[.]top, liderongrade.duckdns[.]org
- [IP Address] C2 and local relay endpoints – 193.169.240[.]81, 192.168.100.4:49727
- [File Hash (SHA256)] fake installer and payloads – c0b4a4af8a3a8c4b113d7f203fcf480cfac79160102490daf287748634b9ce23, 3d7411e2e445a2210dbbf061f3e8e3dd3476a4fc5d4a2135dcceb0bc705776bf
- [File Hash (SHA256)] loader and extension component – 8d921bdd1f5bc8c03209a5dfacfd9ed313497ac2e3f1b4a2000f4c474a464904, cfd9c0bcc89ebc68aae889b9b49bc8290c3764bce5f2c9ac8b5ba0ba58e9bf61
- [File Hash (SHA256)] additional fake apps using the same chain – 590b04e35fc0b3dcd9dabe82f2e96d4d1e0fccc598911cf80f8255232ee75fcb, Ecde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32d, and 1 more hash
- [File Name] dropped or referenced components – CCleaner.exe, runtimebroker.dll, cscript.exe, background.js, content.js