Technical Analysis of Code-Signed “Blister” Malware Campaign (Part 2)

The report analyzes the Blister malware campaign (active since 15 Sep 2021), detailing a code-signed dropper that writes a malicious DLL to Temp, decodes a staged PE payload from resources, employs anti-analysis sleep and heavy obfuscation, and executes the payload via process hollowing into a renamed rundll32.exe. Final-stage payloads observed include information stealers (Raccoon), Cobalt Strike beacons, and BitRAT; persistence is achieved by installing a startup .lnk. The analysis highlights IoCs and recommends updating endpoint/network defenses to detect these behaviors and signed binaries used maliciously.