Stealthy BLISTER malware slips in unnoticed on Windows systems

guest · Dec 23, 2021

December 23, 2021

Security researchers have uncovered a malicious campaign that relies on a valid code-signing certificate to disguise malicious code as legitimate executables.

One of the payloads that the researchers called Blister, acts as a loader for other malware and appears to be a novel threat that enjoys a low detection rate.
Click to expand...

The threat actor behind Blister has been relying on multiple techniques to keep their attacks under the radar, the use of code-signing certificates being only one of their tricks.
Signed, sealed, delivered
Whoever is behind Blister malware has been running campaigns for at least three months, since at least September 15, security researchers from Elastic search company found.

The threat actor used a code-signing certificate that is valid from August 23, though. It was issued by digital identity provider Sectigo for a company called Blist LLC with an email address from a Russian provider Mail.Ru.
Click to expand...

The researchers say that the threat actor relied on multiple techniques to keep the attack undetected. One method was to embed Blister malware into a legitimate library (e.g. colorui.dll).

The malware is then executed with elevated privileges via the rundll32 command. Being signed with a valid certificate and deployed with administrator privileges makes Blister slip past security solutions.
It then kicks into action by decrypting embedded payloads that provide remote access and allow lateral movement: Cobalt Strike and BitRAT - both have been used by multiple threat actors in the past.
Click to expand...

Elastic Security: Elastic Security uncovers BLISTER malware campaign

Key takeaways:

Elastic Security uncovered a stealthy malware campaign that leverages valid code signing certificates to evade detection

A novel malware loader, BLISTER was used to execute second stage malware payloads in-memory and maintain persistence

The identified malware samples have very low or no detections on VirusTotal

Elastic provided layered prevention coverage from this threat out of the box

Click to expand...

moredhelfinland · Dec 24, 2021

Maybe SecureAplus and its Name & Thumbprint Certificated check block this in a first place?

Brummelchen · Dec 24, 2021

maybe, but thats no longer an issue

We responsibly disclosed the activity to Sectigo so they could take action and revoke the abused certificates.
Click to expand...

they need a new cert and ofc they will have. maybe they will change it again before next detection. checking the cert may help, but better is to prevent its intrusion and its behavior as shown

Rundll32.exe C:\Users\user\AppData\Local\Temp\Framwork\axsssig.dll,LaunchColorCpl
Click to expand...

you need to lock or sandbox such calls. the rest see likend article.

moredhelfinland · Dec 24, 2021

If they need a new cert, does it pass SAP Essentials Name and Thumbprint check, i doubt that. So then it can't do anything.
In SAP+ there's already a default rule for rundll, tho its like "always block if rundll runs javacript". Quite good for a basic rule. Sure tech savvys can make their own rules.

Rasheed187 · Dec 25, 2021

mood said: ↑

December 23, 2021

Elastic Security: Elastic Security uncovers BLISTER malware campaign
Click to expand...

I guess it's this type of malware that can often bypass multiple AV's, they are using quite nifty tricks. Cool that Elastic was able to detect this, but they didn't perform too good in the latest AV-Comparatives Business Security Test. Would be interesting to know if a tool like OSArmor could have blocked this malware post execution.

Log in or Sign up

Stealthy BLISTER malware slips in unnoticed on Windows systems

guest Guest

moredhelfinland Registered Member

Brummelchen Registered Member

moredhelfinland Registered Member

Rasheed187 Registered Member

Log in or Sign up

Stealthy BLISTER malware slips in unnoticed on Windows systems

guest Guest

moredhelfinland Registered Member

Brummelchen Registered Member

moredhelfinland Registered Member

Rasheed187 Registered Member

Useful Searches