Cybercriminals Are Using Digitally Signed Qq Component As An Infection Catalyst

snoopy · Dec 29, 2012

December 28th, 2012, 14:23 GMT · By Eduard Kovacs
Cybercriminals Are Using Digitally Signed QQ Component as an Infection Catalyst

Malware developers are often abusing digital signatures in order to ensure that their creations have a better chance of slipping by unnoticed. In one attack analyzed by experts from FireEye, cybercriminals have been using a couple of files apparently signed with valid digital certificates.

When the main dropper is executed, a .dll file and a .exe file are dropped. The .dll file is signed with a forged digital signature apparently from Kaspersky. The executable – QQLive.exe – is signed with a certificate from Chinese company Tencent Technology, better known as the creator of the popular QQ instant messaging service.

The interesting part is that QQLive.exe is a legitimate application that can be downloaded from the QQ website. The trick in this case is that the role of QQLive.exe is to facilitate the loading of the malware’s core DLL. “By itself, the file poses no risk, but when this QQLive.exe is used to load the .DLL, it becomes a catalyst for infection,” FireEye’s J. Gomez noted.

Tencent has been informed that its application is utilized for malicious purposes. The company has admitted that this isn’t the first time when this is happening, but it has still failed to revoke the certificate that is being used to sign the file.

Click to expand...

More here: http:/ ews.softpedia.com ews/Cybercriminals-Are-Using-Digitally-Signed-QQ-Component-as-an-Infection-Catalyst-317646.shtml

Log in or Sign up

Cybercriminals Are Using Digitally Signed Qq Component As An Infection Catalyst

snoopy Registered Members

Share This Page

Log in or Sign up

Cybercriminals Are Using Digitally Signed Qq Component As An Infection Catalyst

snoopy Registered Members

Share This Page

Useful Searches