Procedure examples

TrickBot has come with a signed downloader component.

BLINDINGCAN has been signed with code-signing certificates such as CodeRipper.

Stuxnet used a digitally signed driver with a compromised Realtek certificate.

PAKLOG has used legitimate signed binaries such as PACLOUD.exe for follow-on execution of malicious DLLs through DLL Side-Loading.

StrongPity has been signed with self-signed certificates.

Janicab used a valid AppleDeveloperID to sign the code to get past security restrictions.

TONESHELL has used valid legitimate digital signatures and certificates to evade detection.

Ecipekac has used a valid, legitimate digital signature to evade detection.

BOOKWORM has used valid legitimate digital signatures and certificates to evade detection.

STATICPLUGIN has been signed with a valid Certificate Authority(CA) to circumvent endpoint defenses.

GreyEnergy digitally signs the malware with a code-signing certificate.

PUBLOAD has used valid legitimate digital signatures and certificates to evade detection.

CHIMNEYSWEEP has been dropped by a self-extracting archive signed with a valid digital certificate.

BOOSTWRITE has been signed by a valid CA.

SpicyOmelette has been signed with valid digital certificates.

LockerGoga has been signed with stolen certificates in order to make it look more legitimate.

Anchor has been signed with valid certificates to evade detection by security tools.

SplatDropper has used legitimate signed binaries such as BugSplatHD64.exe for follow-on execution of malicious DLLs through DLL side-loading.

Lumma Stealer has used valid code signing digital certificates from ConsolHQ LTD and Verandah Green Limited to appear legitimate.

Turla has used valid digital certificates from Sysprint AG to sign its Epic dropper.

Gazer versions are signed with various valid certificates; one was likely faked and issued by Comodo for "Solid Loop Ltd," and another was issued for "Ultimate Computer Support Ltd."

Metamorfo has digitally signed executables using AVAST Software certificates.

Bandook was signed with valid Certum certificates.

PipeMon, its installer, and tools are signed with stolen code-signing certificates.

RedLine Stealer has used both valid certificates and self-signed digital certificates to appear legitimate.

The Black Basta dropper has been digitally signed with a certificate issued by Akeo Consulting for legitimate executables used for creating bootable USB drives.

RTM samples have been signed with a code-signing certificates.

StrelaStealer variants have used valid code signing certificates.

GoBear uses stolen legitimate code signing certificates for defense evasion.

Bazar has been signed with fake certificates including those appearing to be from VB CORPORATE PTY. LTD.

CorKLOG has used legitimate signed binaries such as lcommute.exe for follow-on execution of malicious DLLs through DLL side-loading.

The HermeticWiper executable has been signed with a legitimate certificate issued to Hermetica Digital Ltd.

Cobalt Strike can use self signed Java applets to execute signed applet attacks.

SUNBURST was digitally signed by SolarWinds from March - May 2020.

Some Daserf samples were signed with a stolen digital certificate.

MacMa has been delivered using ad hoc Apple Developer code signing certificates.

ROADSWEEP has been digitally signed with a certificate issued to the Kuwait Telecommunications Company KSC.

More_eggs has used a signed binary shellcode loader and a signed Dynamic Link Library (DLL) to create a reverse shell.

SysUpdate has been signed with stolen digital certificates.

BackConfig has been signed with self signed digital certificates mimicking a legitimate software company.

Nerex drops a signed Microsoft DLL to disk.

Clop can use code signing to evade detection.

SPAWNCHIMERA has generated RSA keys against modified files to sign the manifest file, so they appear legitimate.

Troll Stealer, along with its associated dropper, utilizes legitimate, stolen code signing certificates.

Ebury has installed a self-signed RPM package mimicking the original system package on RPM based systems.

ChChes samples were digitally signed with a certificate originally used by Hacking Team that was later leaked and subsequently revoked.

AppleJeus has used a valid digital signature from Sectigo to appear legitimate.

QakBot can use signed loaders to evade detection.

Helminth samples have been signed with legitimate, compromised code signing certificates owned by software company AI Squared.

HermeticWizard has been signed by valid certificates assigned to Hermetica Digital.