Technique:  Subvert Trust Controls:Code Signing
Anchor has been signed with valid certificates to evade detection by security tools.
AppleJeus has used a valid digital signature from Sectigo to appear legitimate.
It leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations.
BackConfig has been signed with self signed digital certificates mimicking a legitimate software company.
Bandook was signed with valid Certum certificates.
Bazar has been signed with fake certificates including those appearing to be from VB CORPORATE PTY. LTD.
The Black Basta dropper has been digitally signed with a certificate issued by Akeo Consulting for legitimate executables used for creating bootable USB drives.
BLINDINGCAN has been signed with code-signing certificates such as CodeRipper.
BOOSTWRITE has been signed by a valid CA.
For C0015, the threat actors used DLL files that had invalid certificates.
ChChes samples were digitally signed with a certificate originally used by Hacking Team that was later leaked and subsequently revoked.
Clop can use code signing to evade detection.
Cobalt Strike can use self signed Java applets to execute signed applet attacks.
It digitally signed an executable with a stolen certificate from legitimate company AI Squared.
CSPY Downloader has come signed with revoked certificates.
It has used code-signing certificates on its malware that are either forged due to weak keys or stolen. It has also stolen certificates and signed backdoors and downloaders with them.
Some Daserf samples were signed with a stolen digital certificate.
Ebury has installed a self-signed RPM package mimicking the original system package on RPM based systems.
Ecipekac has used a valid, legitimate digital signature to evade detection.
It has used stolen certificates from Electrum Technologies GmbH to sign payloads.
It has used valid digital certificates from Sysprint AG to sign its Epic dropper.
It has used Comodo code-signing certificates.
It has signed It payloads with legally purchased code signing certificates. It has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.
It has used stolen certificates to sign its tools including those from Whizzimo LLC.
Gazer versions are signed with various valid certificates; one was likely faked and issued by Comodo for "Solid Loop Ltd," and another was issued for "Ultimate Computer Support Ltd."
GreyEnergy digitally signs the malware with a code-signing certificate.
Helminth samples have been signed with legitimate, compromised code signing certificates owned by software company AI Squared.
The HermeticWiper executable has been signed with a legitimate certificate issued to Hermetica Digital Ltd.
HermeticWizard has been signed by valid certificates assigned to Hermetica Digital.
Janicab used a valid AppleDeveloperID to sign the code to get past security restrictions.
It has signed files with the name EGIS CO,. Ltd..
It has digitally signed malware and utilities to evade detection.
It has used stolen code signing certificates to sign malware.
LockerGoga has been signed with stolen certificates in order to make it look more legitimate.
It has signed their malware with a valid digital signature.
It has resized and added data to the certificate table to enable the signing of modified files with legitimate signatures.
Metamorfo has digitally signed executables using AVAST Software certificates.
It has used forged Microsoft code-signing certificates on malware.
More_eggs has used a signed binary shellcode loader and a signed Dynamic Link Library (DLL) to create a reverse shell.
It has used signed drivers from an open source tool called DiskCryptor to evade detection.
Nerex drops a signed Microsoft DLL to disk.
During Operation Dream Job, It digitally signed their own malware to evade detection.
During Operation Honeybee, the threat actors deployed the MaoCheng dropper with a stolen Adobe Systems digital signature.
It has signed malware with self-signed certificates from fictitious and spoofed legitimate software companies.
PipeMon, its installer, and tools are signed with stolen code-signing certificates.
It has signed code with self-signed certificates.
QakBot can use signed loaders to evade detection.
A QuasarRAT .dll file is digitally signed by a certificate from AirVPN.
It samples have been signed with a code-signing certificates.
It has used self-signed and stolen certificates originally issued to NVIDIA and Global Software LLC.
It has used a valid certificate to sign their primary loader It.Downloader (aka TrueBot).
During the SolarWinds Compromise, It was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.
SpicyOmelette has been signed with valid digital certificates.
StrongPity has been signed with self-signed certificates.
Stuxnet used a digitally signed driver with a compromised Realtek certificate.
It has used stolen certificates to sign its malware.
SUNBURST was digitally signed by SolarWinds from March - May 2020.
SysUpdate has been signed with stolen digital certificates.
It has signed payloads with code signing certificates from Thawte and Sectigo.
TrickBot has come with a signed downloader component.
It used stolen certificates to sign its malware.
It has used Digicert code-signing certificates for some of its malware.