Subvert Trust Controls: Code Signing

APT37 has signed its malware with an invalid digital certificates listed as "Tencent Technology (Shenzhen) Company Limited."^[33]

APT41 leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations.^[41]

BackConfig has been signed with self signed digital certificates mimicking a legitimate software company.^[25]

BADNEWS is sometimes signed with an invalid Authenticode certificate in an apparent effort to make it look more legitimate.^[16]

BOOSTWRITE has been signed by a valid CA.^[23]

ChChes samples were digitally signed with a certificate originally used by Hacking Team that was later leaked and subsequently revoked.^[9][10][11]

CopyKittens digitally signed an executable with a stolen certificate from legitimate company AI Squared.^[31]

Darkhotel has used code-signing certificates on its malware that are either forged due to weak keys or stolen. Darkhotel has also stolen certificates and signed backdoors and downloaders with them.^[28][29]

Some Daserf samples were signed with a stolen digital certificate.^[6]

Ebury has installed a self-signed RPM package mimicking the original system package on RPM based systems.^[20]

Turla has used valid digital certificates from Sysprint AG to sign its Epic dropper.^[19]

FIN6 has used Comodo code-signing certificates.^[22]

FIN7 has signed Carbanak payloads with legally purchased code signing certificates. FIN7 has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.^[26][27]

Gazer versions are signed with various valid certificates; one was likely faked and issued by Comodo for "Solid Loop Ltd," and another was issued for "Ultimate Computer Support Ltd."^[13][14]

GreyEnergy digitally signs the malware with a code-signing certificate.^[18]

Helminth samples have been signed with legitimate, compromised code signing certificates owned by software company AI Squared.^[7]

Honeybee uses a dropper called MaoCheng that harvests a stolen digital signature from Adobe Systems.^[36]

Janicab used a valid AppleDeveloperID to sign the code to get past security restrictions.^[15]

Leviathan has used stolen code signing certificates to sign malware.^[34][35]

LockerGoga has been signed with stolen certificates in order to make it look more legitimate.^[21]

Metamorfo has digitally signed executables using Avast.^[24]

Molerats has used forged Microsoft code-signing certificates on malware.^[32]

More_eggs has used a signed binary shellcode loader and a signed Dynamic Link Library (DLL) to create a reverse shell.^[22]

Nerex drops a signed Microsoft DLL to disk.^[8]

The NETWIRE client has been signed by fake and invalid digital certificates.^[12]

Patchwork has signed malware with self signed certificates from fictitious and spoofed legitimate software companies.^[25]

A QuasarRAT .dll file is digitally signed by a certificate from AirVPN.^[4]

RTM samples have been signed with a code-signing certificates.^[17]

SDelete is digitally signed by Microsoft.^[5]

Silence has used a valid certificate to sign their primary loader Silence.Downloader (aka TrueBot).^[42]

Suckfly has used stolen certificates to sign its malware.^[37]

TA505 has signed payloads with code signing certificates from Thawte and Sectigo.^[38][39][40]

Winnti Group used stolen certificates to sign its malware.^[30]