value:  BOOSTWRITE has been signed by a valid CA. ;; ChChes samples were digitally signed with a certificate originally used by Hacking Team that was later leaked and subsequently revoked. ;; Cobalt Strike can use self signed Java applets to execute signed applet attacks. ;; CopyKittens digitally signed an executable with a stolen certificate from legitimate company AI Squared. ;; CSPY Downloader has come signed with revoked certificates. ;; Darkhotel has used code-signing certificates on its malware that are either forged due to weak keys or stolen. Darkhotel has also stolen certificates and signed backdoors and downloaders with them. ;; Some Daserf samples were signed with a stolen digital certificate. ;; Ebury has installed a self-signed RPM package mimicking the original system package on RPM based systems. ;; Turla has used valid digital certificates from Sysprint AG to sign its Epic dropper. ;; FIN6 has used Comodo code-signing certificates. ;; FIN7 has signed Carbanak payloads with legally purchased code signing certificates. FIN7 has also digitally signed their phishing documents backdoors and other staging tools to bypass security controls. ;; GALLIUM has used stolen certificates to sign its tools including those from Whizzimo LLC. ;; Gazer versions are signed with various valid certificates; one was likely faked and issued by Comodo for Solid Loop Ltd " and another was issued for "Ultimate Computer Support Ltd." ;; GreyEnergy digitally signs the malware with a code-signing certificate. ;; Helminth samples have been signed with legitimate compromised code signing certificates owned by software company AI Squared. ;; Honeybee uses a dropper called MaoCheng that harvests a stolen digital signature from Adobe Systems. ;; Janicab used a valid AppleDeveloperID to sign the code to get past security restrictions. ;; Kimsuky has signed files with the name EGIS CO . Ltd.. ;; Leviathan has used stolen code signing certificates to sign malware. ;; LockerGoga has been signed with stolen certificates in order to make it look more legitimate. ;; Metamorfo has digitally signed executables using AVAST Software certificates. ;; Molerats has used forged Microsoft code-signing certificates on malware. ;; More_eggs has used a signed binary shellcode loader and a signed Dynamic Link Library (DLL) to create a reverse shell. ;; Nerex drops a signed Microsoft DLL to disk. ;; Patchwork has signed malware with self-signed certificates from fictitious and spoofed legitimate software companies. ;; PipeMon its installer and tools are signed with stolen code-signing certificates. ;; PROMETHIUM has signed code with self-signed certificates. ;; A QuasarRAT .dll file is digitally signed by a certificate from AirVPN. ;; RTM samples have been signed with a code-signing certificates. ;; Silence has used a valid certificate to sign their primary loader Silence.Downloader (aka TrueBot). ;; StrongPity has been signed with self-signed certificates. ;; Suckfly has used stolen certificates to sign its malware. ;; SUNBURST was digitally signed by SolarWinds from March - May 2020. ;; TA505 has signed payloads with code signing certificates from Thawte and Sectigo. ;; TrickBot has come with a signed downloader component. ;; UNC2452 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle. ;; Winnti Group used stolen certificates to sign its malware. ;; Wizard Spider has used Digicert code-signing certificates for some of its malware."
name: Subvert Trust Controls: Code Signing