Security News > 2021 > December > New BLISTER Malware Using Code Signing Certificates to Evade Detection

Cybersecurity researchers have disclosed details of an evasive malware campaign that makes use of valid code signing certificates to sneak past security defenses and stay under the radar with the goal of deploying Cobalt Strike and BitRAT payloads on compromised systems.

The binary, a loader, has been dubbed "Blister" by researchers from Elastic Security, with the malware samples having negligible to zero detections on VirusTotal.

A notable aspect of the attacks is that they leverage a valid code signing certificate issued by Sectigo.

The malware has been observed signed with the certificate in question dating back to September 15, 2021.

"Executables with valid code signing certificates are often scrutinized to a lesser degree than unsigned executables," researchers Joe Desimone and Samir Bousseaden said.

Blister masquerades as a legitimate library called "Colorui.dll" and is delivered via a dropper named "Dxpo8umrzrr1w6gm.exe." Post execution, the loader is designed to sleep for 10 minutes, likely in an attempt to evade sandbox analysis, only to follow it up by establishing persistence and decrypting an embedded malware payload such as Cobalt Strike or BitRAT. "Once decrypted, the embedded payload is loaded into the current process or injected into a newly spawned WerFault.exe process," the researchers noted.

News URL

https://thehackernews.com/2021/12/new-blister-malware-using-code-signing.html