Tuesday, April 16, 2024

FIN7 Hackers Added New Hacking Tool BIOLOAD to Evade AV Detection – Attacks Windows 64-bit OS

Researchers observed a new tool attributed to the FIN7 hacker group dubbed BIOLOAD aimed to minimize the footprint in the victim machine and to avoid detection.

The new tool has similarities with FIN7’s BOOSTWRITE tool that abuses the DLL search order of applications to get executed. BOOSTWRITE abuses legitimate ‘Dwrite.dll’ provided by the Microsoft DirectX Typography Services.

FIN7 New Tool

BIOLOAD is the new version of the BOOSTWRITE tool, both of them having the same codebase and drops the Carbanak backdoor. Both the tools taking advantage of the Windows OS method to look for required DLLs to load into a program.

The BIOLOAD tool abuses FaceFodUninstaller.exe (“%WINDR%\System32\WinBioPlugIns”) that exist with the Windows OS installation and this executable depends on the winbio.dll (“%WINDR%\System32”). The FaceFodUninstaller has a built-in scheduled task which grabs attackers’ interest to target this executable.

Attackers leverage the default DLL search order by placing the fake version of WinBio.dll(contains upper case letters) int he same folder of FaceFodUninstaller “%WINDR%\System32\WinBioPlugIns”, to place the “attacker needed to have elevated privileges on the victim’s machine such as an administrator or a SYSTEM account,” reads Fortinet blog post.

DLL placed in Executable Folder

BIOLOAD was written in C++, compiled in March and July of 2019, it specifically targets 64-bit OS machines. It has an encrypted payload embedded like BOOSTWRITE, for decryption it uses XOR algorithm or fetches. Like BOOSTWRITE, BIOLOAD also supports only a single payload.

The loader carries the newly built version of the Carbanak Backdoor, dated January and April of 2019, according to their timestamps.

Researchers noted that backdoor “checks to see if another Anti-Virus (AV) is running on the machine, besides Kaspersky, AVG, and TrendMicro. The result, however, does not affect the operations of the backdoor, unlike with previously detected AVs.”

FIN7 hacker group found to be active since mid-2015, the group continues adding new tools to their arsenal to defeat security solutions.

Both the BIOLOAD and the new version of Carbanak remain undetected by most of the AV engines, here are the results from the virus total 1,2 at the time of writing.


WinBio.dll (scrubbed key and payload) SHA256

Carbanak SHA256

Latest articles

Hacker Customize LockBit 3.0 Ransomware to Attack Orgs Worldwide

Cybersecurity researchers at Kaspersky have uncovered evidence that cybercriminal groups are customizing the virulent...

Microsoft .NET, .NET Framework, & Visual Studio Vulnerable To RCE Attacks

A new remote code execution vulnerability has been identified to be affecting multiple Microsoft...

LightSpy Hackers Indian Apple Device Users to Steal Sensitive Data

The revival of the LightSpy malware campaign has been observed, focusing on Indian Apple...

LightSpy Malware Attacking Android and iOS Users

A new malware known as LightSpy has been targeting Android and iOS users.This sophisticated...

This Startup Aims To Simplify End-to-End Cybersecurity, So Anyone Can Do It

The Web3 movement is going from strength to strength with every day that passes....

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles