Researchers at security company Zscaler have found malware that uses compromised digital certificates to evade detection. Dubbed Spymel, it uses a .NET executable signed with a legitimate DigiCert-issued certificate. The malware allows malicious actors to steal information from compromised machines and spy on victims.

How Spymel Abuses Digital Certificates

Spymel is a Trojan that starts with JavaScript that is not obfuscated. This malware typically will show up via a spammed email. The executable, which is obfuscated, gets downloaded from a location hard-coded in the JavaScript.

“[The] .NET binary … is digitally signed with a certificate issued to SBO INVEST,” Zscaler researchers noted. “The certificate was promptly revoked by DigiCert when notified and, therefore, is not active in any attack. We noticed a newer variant arose within two weeks of the first variant, using another certificate issued to SBO INVEST that is also revoked.”

The configuration data, including command-and-control (C&C) servers as well as file and registry information, is hard-coded within the executable. The C&C server is hosted on the android.sh domain, which has a German IP address. The malware communicates via port 1216.

SecurityWeek reported that Spymel is designed to work on both Windows XP and Windows 7 systems.

Many Functions, All Invasive

There are several modules to Spymel. One is a keylogger, which is a module that logs all user keystrokes into a log file at %Application Data%\ProgramFiles(32.1)\svchost.exe.tmp.

Zscaler found that the C&C server may send a host of commands to infected machines. These include collecting information about the infected system and the files found on it, as well as deleting, executing or renaming a specified file. A specified file can be uploaded to the C&C and so can a screenshot of the desktop. Enabling or disabling video recording can also be performed.

A ProtectMe module allows Spymel to prevent the user from terminating the malware or run other processes. Tools such as TaskMgr, Procexp, ProcessHacker and Taskkill are disabled by making the OK button on the confirmation prompt for Process Explorer not appear as a valid choice. It does this by using the GetForegroundWindow() API to get a handle of the active window and change how it works.

Abuse of digital certificates has been a technique used by malware in the past. SecurityWeek noted that more than 6,000 cases of malware using certs was recording in 2014 alone.