CCleaner Cloud version 1.07.3191 is also reported to be affected. The issue was discovered and reported by both Morphisec and Cisco in separate in-field cases and reported separately to Avast. This post was authored by: Edmund Brumaghin, Ross Gibb, Warren Mercer, Matthew Molyett, and Craig Williams. The fallback command and control scheme in use by the CCBkdr involves: Generating a Monthly Domain name (all of which are controlled by Talos for 2017) Request the A records for the domain. The true destination IP is then computed and connected to the true destination.”]
Source: https://blog.talosintelligence.com/2017/09/avast-distributes-malware.html