H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

BOOSTWRITE

[BOOSTWRITE](https://attack.mitre.org/software/S0415) is a loader crafted to be launched via abuse of the DLL search order of applications used by [FIN7](https://attack.mitre.org/groups/G0046).(Citation: FireEye FIN7 Oct 2019)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[BOOSTWRITE](https://attack.mitre.org/software/S0415) is a loader crafted to be launched via abuse of the DLL search order of applications used by [FIN7](https://attack.mitre.org/groups/G0046).(Citation: FireEye FIN7 Oct 2019)

Labels

malware
6 recorded

Relationships

uses
to Code Signing
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to DLL
Technique
uses
to Encrypted/Encoded File
Technique
uses
to Shared Modules
Technique
uses
from FIN7
Group
2 external

References

mitre-attack
S0415
open
FireEye FIN7 Oct 2019
https://www.fireeye.com/blog/threat-research/2019/10/mahalo-fin7-responding-to-new-tools-and-techniques.html
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance