Check to see if CCleaner is installed and fingerprints of the trojan are present (osquery)

Description: Check to see if CCleaner is installed and fingerprints of the trojan are present.

SQL:

SELECT h.md5, h.sha1, h.sha256, s.name, s.service_type, s.display_name, s.module_path, s.user_account 
FROM services s, hash h 
WHERE h.path = s.module_path 
and ((s.module_path like '%GeeSetup_x86%' and h.sha256 = 'dc9b5e8aa6ec86db8af0a7aa897ca61db3e5f3d2e0942e319074db1aaccfdc83') 
or (s.module_path like '%EFACli64%' and h.sha256 = '128aca58be325174f0220bd7ca6030e4e206b4378796e82da460055733bb6f4f') 
or (s.module_path like '%TSMSISrv%' and h.sha256 = '07fb252d2e853a9b1b32f30ede411f2efbb9f01e4a7782db5eacf3f55cf34902'));

Operating Systems: Windows Only

Reference:

• https://raw.githubusercontent.com/osquery/osquery/master/packs/windows-attacks.confhttps://blog.talosintelligence.com/2017/09/avast-distributes-malware.html

#ccleaner #malware #trojan