# Elastic Security uncovers BLISTER malware campaign

BLISTER loader, signed with a valid Sectigo code-signing cert, executes in-memory second-stage payloads (CobaltStrike/BitRat) and persists via Startup folder.

- Payout: Real-world hack
- Program: BLISTER
- Analysis by: Joe Desimone, Samir Bousseaden
- Disclosed: 2022-08-03
- Write-up quality: 6/10
- Original: https://www.elastic.co/security-labs/threat-command/elastic-security-uncovers-blister-malware-campaign
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-security-uncovers-blister-malware-campaign
- Tags: area:os domain:desktop impact:integrity impact:rce kind:incident platform:threat-intel tech:windows technique:reverse-engineering technique:source-review vuln:misconfiguration

**Target:** Windows endpoint (rundll32 DLL loader, WerFault.exe injection)
**Root cause:** A valid code signing certificate is used to sign malware to help the attackers remain under the radar of the security community. The loader is spliced into legitimate libraries to keep most on-disk code known-good.
**Steps:**
1. Dropper writes signed BLISTER loader to `%temp%\Framwork\axsssig.dll`
2. Execute via `Rundll32.exe C:\Users\user\AppData\Local\Temp\Framwork\axsssig.dll,LaunchColorCpl`
3. Loader decodes resource-section bootstrap code with a 4-byte XOR routine
4. Bootstrap sleeps 10 minutes to evade sandbox analysis
5. Decrypts embedded payload (CobaltStrike or BitRat)
6. Loads payload into current process or injects into newly spawned WerFault.exe
7. Copies itself to C:\ProgramData with renamed rundll32.exe and creates Startup folder link for logon persistence
**How found:** Elastic Security reviewed threat prevention telemetry and spotted a cluster of malicious activity; noted signed binaries with low/no VirusTotal detections and a novel loader spliced into legitimate libraries.
**Exploitation:** Signed dropper executes BLISTER DLL via rundll32 LaunchColorCpl export; XOR-decoded bootstrap sleeps 10 min, decrypts embedded CobaltStrike/BitRat, injects into WerFault.exe, and persists via Startup folder shortcut launched as child of explorer.exe.
**Insight:** Attackers splice loaders into legitimate DLLs and sign with purchased certs so most on-disk bytes are known-good; hunt for renamed rundll32 (original_file_name RUNDLL32.EXE) and single-arg WerFault.exe as masquerading indicators.

## Proof of concept (copied exactly from the original report)

**Rundll32 command launching BLISTER loader DLL**

```
Rundll32.exe C:\Users\user\AppData\Local\Temp\Framwork\axsssig.dll,LaunchColorCpl
```

**YARA rule for BLISTER loader**

```
rule Windows_Trojan_Blister{
 meta:
 author = “Elastic Security”
 creation_date = "2021-12-20"
 last_modified = "2021-12-20"
 os = "Windows"
 category_type = "Trojan"
 family = "Blister"
 threat_name = "Windows.Trojan.Blister"
 reference_sample = "0a7778cf6f9a1bd894e89f282f2e40f9d6c9cd4b72be97328e681fe32a1b1a00"

 strings:
 $a1 = {8D 45 DC 89 5D EC 50 6A 04 8D 45 F0 50 8D 45 EC 50 6A FF FF D7}
 $a2 = {75 F7 39 4D FC 0F 85 F3 00 00 00 64 A1 30 00 00 00 53 57 89 75}
condition:
 any of them
}
```

**Hunt query for renamed rundll32 proxy execution**

```
process where event.action == "start" and
process.name != null and
(process.pe.original_file_name == "RUNDLL32.EXE" and not process.name : "RUNDLL32.EXE")
```