Certificate Bypass: Hiding and Executing Malware from a Digitally Signed Executable

Malware developers are constantly looking for new ways to evade the detection and prevention capabilities of security solutions. In recent years, we have seen many different tools, such as new encryption techniques and others, that help malware reach this goal of hiding the malicious code. To further complicate the matter, new technique for hiding malware (encrypted and un-encrypted) is presented in BlackHat conference, that hide malware inside a digitally signed file (while still keeping the file with a valid certificate) and executing it from the memory, using a benign executable (which acts as a reflective EXE loader, written from scratch). The research demonstrates our Certificate Bypass tool and the Reflective EXE Loader.



For White Paper for this research: Click Here!