Comodo Digital Sign on a Malware!

Learn about Computer Security Digital Certificates and Digital Signing
1

Hello,

I just saw this : https://twitter.com/BelchSpeak/status/659075998688923649
The image is here : http://i.hizliresim.com/QWVq1k.png

It is not normal, can you prevent this kind of problems guys? What does it mean, I really know nothing about digital signing?

Thank you.

2

I sent a pm to Comodo.

For those interested this is the Virus Total report: VirusTotal .

3

What a pity that is an upatre sample…

4

I got reply from Rich_S stating it will get revoked back to date of issuance which will invalidate the signature.

What does upatre mean? The Merriam-Webster dictionary does not know it.

5

It is a malware type.
You can check here : UPATRE - Threat Encyclopedia
and I am sad about it now Comodo has no encyclopedia like this one.

6

It is not detected by Comodo. I submitted it and gave you the props.

7

In fact, I did not check that digital signature is in Comodo Trusted Vendor List? Can you please check it for me?
“Time Divers Ltd” = http://i.hizliresim.com/vR600A.jpg
If Comodo TVL trusts the file, then the detection will not work.
This is a small but serious hole in CIS security “Trusted Malwares”

Comodo detected the file : VirusTotal as TrojWare.Win32.Waski.CERT

8

Time Divers is not on the TVL.

9

Hello EricJH,

Can you please report this Cryptolocker to Comodo employees?
Comodo is the signer of this malware :-TD :-TD Check file details…

645×547 38.1 KB

Please inform me about it.

10

I sent a pm.

11

I got a pm yesterday that Comodo is on it.

12

Thanks EricJH!

13

I connected with Rich_s about this and he asked to submit malware that is signed by Comodo code signing certificate by email. I updated the topic start of Report trusted and whitelisted malware here - 2015 (NO LIVE MALWARE!):

Next time you can submit the malware samples to the mentioned email address for quick processing.