Revisiting BLISTER: New development of the BLISTER loader

Elastic Security Labs analyzes the evolving BLISTER malware loader, detailing new capabilities including environment-specific execution (domain hashing), unhooking of process instrumentation to evade userland syscall detection, configurable anti-debug timing, revised configuration structure, and changes to hashing. The report documents BLISTER's use to smuggle malicious code into legitimate libraries (e.g., VLC DLL), its deployment of MYTHIC implants in recent campaigns, low detection rates, provided YARA rules, and downloadable observables for detection and response.