Signing certificates
Certificates observed signing tracked samples. Treat shared certificates as a lead, not proof: malware authors reuse keys, and Android samples are very often signed with the public Android debug certificate — a shared cert only narrows the search.
| Subject (CN) | SHA-256 fingerprint | Families | Samples |
|---|---|---|---|
| 123456 | e4e4b72303db3737… | MMRat | 5 |
| Android | a40da80a59d170ca… | APT36, AhMyth, AndroRat, BladeHawk, ProSpy, SyrianMT, Xenomorph | 16 |
| Android | c737d4485261f48a… | APT41 | 2 |
| Android | c8a2e9bccf597c2f… | SyrianMT | 1 |
| Android | cc8c0d961d882f2b… | APT41 | 2 |
| Android Debug | 1e08a903aef9c3a7… | AhMyth, AndroRat | 3 |
| Android Debug | 5471db1ca710f51f… | SK TelecomFraud | 1 |
| Android Debug | 854ffef7227746ad… | SK TelecomFraud | 3 |
| Android Debug | a8140f7313074010… | CapraRat | 1 |
| Android Debug | afa47e0fc07dfae6… | DCHSpy | 2 |
| Android Debug | c017283419cd62f9… | APT41 | 1 |
| Android Debug | cd7cf3738547a178… | DCHSpy | 2 |
| Debug | c1e2b02373e696fb… | CECbot | 1 |
| Devid John | 541ffb2cc7df82f5… | ProSpy | 1 |
| hmza | 03a5d68002a6124c… | APT-C-27 | 2 |
| hmza | 0ff88fd1031138a2… | APT-C-27 | 3 |
| Jamal Hassan | 26768fa08ed2ec3f… | APT-C-23 | 1 |
| James Miller | 3c72ae03839502d2… | Bitter | 1 |
| Jarhead Alpha | d20aba6d09f06d2a… | Bitter | 1 |
| Lorensius W. L. T | 518ac8bdaf0c767d… | SandroRat, SyrianMT | 3 |
| Milky Way | c886911f1a2e9915… | Xenomorph | 1 |
| System Update | fd46caca706cb70e… | CECbot | 1 |
| tucsand | 87d898cbd0a0d42c… | Bitter, ProSpy | 1 |
| User One | 864ffd08404c3dba… | APT-C-23 | 1 |