Executable-Signing Certificates Samples are usually signed with a fake certificate – we’ve seen two instances, one AMD and one Intel:  Configuration files: Some of the malware uses an encrypted configuration file which is stored on disk as “racss.dat”