POPPING BLISTERS FOR RESEARCH: AN OVERVIEW OF PAST PAYLOADS AND EXPLORING RECENT DEVELOPMENTS

Summary from the TLDR InfoSec newsletter

This article provides an overview of Blister, a malware loader that loads a payload embedded within it. The authors analyze past payloads dropped by Blister loaders based on 137 unpacked samples from the past year and a half and explore recent developments. The analysis shows that Blister is mostly used in a targeted manner with Mythic agents as its payload of choice. The article provides YARA rules and scripts to help analyze the Mythic agent and the packer observed with it.