Nasty new malware strain creeps quietly past Windows defenses
Security researchers have identified a new malware campaign that leverages code signing certificates and other techniques to help it avoid detection by antivirus software.
According to a new blog post from Elastic Security, the cybersecurity firm’s researchers identified a cluster of malicious activity after reviewing its threat prevention telemetry.
The cybercriminals behind this new campaign are using valid code signing certificates to sign malware to help them remain under the radar of the security community. However, Elastic Security also discovered a new malware loader used in the campaign that it has named Blister.
Due to the use of valid code signing certificates and other measures taken to avoid detection, the cybercriminals responsible have been running this new campaign for at least three months.
Blister malware
The cybercriminals are using a code signing certificate issued by the digital identity firm Sectigo for a company called Blist LLC which is why Elastic Security gave their malware loader the name Blister. They may also be operating out of Russia as they are using Mail.Ru as their email service.
In addition to using a valid code signing certificate, the cybercriminals also relied on other techniques to remain undetected including embedding the Blister malware into a legitimate library. After being executed with elevated privileges by using the rundll32 command, the malware decodes bootstrapping code that is heavily obfuscated and stored in the resource section. From here, the code remains dormant for ten minutes to evade sandbox analysis.
Once enough time has passed, the malware starts up and begins decrypting embedded payloads that allow it to access a Windows system remotely and move laterally across a victim’s network. Blister also achieves persistence on an infected machine by storing a copy in the ProgramData folder as well as another posing as rundll32.exe. To make matters worse, the malware is added to a system’s startup location so it launches every time a machine boots.
Elastic Security has notified Sectigo to have Blister’s code signing certificate revoked though the firm has also created a Yara rule to help organization’s identify the new malware.
We’ve also…
