FIN7__2019__Mahalo_FIN7.pdf

FireEye/Mandiant describes FIN7’s newly observed tools: BOOSTWRITE, an in-memory DLL-search-order loader that retrieves decryption keys from a remote server and loads encrypted payloads (including CARBANAK), and RDFSNIFFER, a payload that hooks Win32 APIs to tamper with or hijack NCR Aloha Command Center Client sessions (allowing file upload/download, execute, and deletion). The blog details technical behaviors, code-signing evasions (signed sample with anomalous timestamps), sample hashes/C2s, Yara hunting ideas, MITRE ATT&CK mappings, and recommended detection approaches.