BOATLAUNCH
- First seen
- 2020-06-15 00:00:00
- Malware type
- loader
- Profile updated
- 2026-07-07 13:22:01
Targeted industries: financial-services retail-and-hospitality
Context
FIN7 uses this malware as helper module during intrusion operations. BOATLAUNCH is continuously looking for PowerShell processes on infected systems and patches them to bypuss Windows AntiMalware Scan Interface (AMSI).
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Boatlaunch_Auto (yara-rule)
Reports & references
- Mandiant — Evolution Of Fin7 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Boatlaunch (report)