Description: Check to see if CCleaner is installed and fingerprints of the trojan are present.
SQL:
SELECT h.md5, h.sha1, h.sha256, s.name, s.service_type, s.display_name, s.module_path, s.user_account
FROM services s, hash h
WHERE h.path = s.module_path
and ((s.module_path like '%GeeSetup_x86%' and h.sha256 = 'dc9b5e8aa6ec86db8af0a7aa897ca61db3e5f3d2e0942e319074db1aaccfdc83')
or (s.module_path like '%EFACli64%' and h.sha256 = '128aca58be325174f0220bd7ca6030e4e206b4378796e82da460055733bb6f4f')
or (s.module_path like '%TSMSISrv%' and h.sha256 = '07fb252d2e853a9b1b32f30ede411f2efbb9f01e4a7782db5eacf3f55cf34902'));
Operating Systems: Windows Only
Reference:
#ccleaner #malware #trojan