SYMBOLCOMMON_NAMEaka. SYNONYMS
win.finfisher (Back to overview)

FinFisher RAT

aka: FinSpy

FinFisher is a commercial software used to steal information and spy on affected victims. It began with few functionalities which included password harvesting and information leakage, but now it is mostly known for its full Remote Access Trojan (RAT) capabilities. It is mostly known for being used in governmental targeted and lawful criminal investigations. It is well known for its anti-detection capabilities and use of VMProtect.

References
2021-03-21BlackberryBlackberry Research
@techreport{research:20210321:2021:a393473, author = {Blackberry Research}, title = {{2021 Threat Report}}, date = {2021-03-21}, institution = {Blackberry}, url = {https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf}, language = {English}, urldate = {2021-03-25} } 2021 Threat Report
Bashlite FritzFrog IPStorm Mirai Tsunami elf.wellmess AppleJeus Dacls EvilQuest Manuscrypt Astaroth BazarBackdoor Cerber Cobalt Strike Emotet FinFisher RAT Kwampirs MimiKatz NjRAT Ryuk SmokeLoader TrickBot
2020-10-14Netzpolitik.orgAndre Meister
@online{meister:20201014:german:be3eea7, author = {Andre Meister}, title = {{German Made State Malware Company FinFisher Raided}}, date = {2020-10-14}, organization = {Netzpolitik.org}, url = {https://netzpolitik.org/2020/our-criminal-complaint-german-state-malware-company-finfisher-raided/}, language = {English}, urldate = {2020-10-15} } German Made State Malware Company FinFisher Raided
FinFisher FinFisher FinFisher FinFisher RAT
2020-09-25Amnesty InternationalAmnesty International
@online{international:20200925:germanmade:49d85d3, author = {Amnesty International}, title = {{German-made FinSpy spyware found in Egypt, and Mac and Linux versions revealed}}, date = {2020-09-25}, organization = {Amnesty International}, url = {https://www.amnesty.org/en/latest/research/2020/09/german-made-finspy-spyware-found-in-egypt-and-mac-and-linux-versions-revealed/}, language = {English}, urldate = {2020-09-25} } German-made FinSpy spyware found in Egypt, and Mac and Linux versions revealed
FinFisher FinFisher FinFisher FinFisher RAT
2019-08-01Kaspersky LabsGReAT
@online{great:20190801:trends:5e25d5b, author = {GReAT}, title = {{APT trends report Q2 2019}}, date = {2019-08-01}, organization = {Kaspersky Labs}, url = {https://securelist.com/apt-trends-report-q2-2019/91897/}, language = {English}, urldate = {2020-08-13} } APT trends report Q2 2019
ZooPark magecart POWERSTATS Chaperone COMpfun EternalPetya FinFisher RAT HawkEye Keylogger HOPLIGHT Microcin NjRAT Olympic Destroyer PLEAD RokRAT Triton Zebrocy Microcin
2018-03-01MicrosoftOffice 365 Threat Research Team, Microsoft Defender ATP Research Team
@online{team:20180301:finfisher:e1de78f, author = {Office 365 Threat Research Team and Microsoft Defender ATP Research Team}, title = {{FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines}}, date = {2018-03-01}, organization = {Microsoft}, url = {https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/}, language = {English}, urldate = {2020-01-08} } FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines
FinFisher RAT
2018-01-24ESET ResearchFilip Kafka
@techreport{kafka:20180124:esets:246a0d4, author = {Filip Kafka}, title = {{ESET’S GUIDE TODEOBFUSCATING AND DEVIRTUALIZING FINFISHER}}, date = {2018-01-24}, institution = {ESET Research}, url = {https://www.welivesecurity.com/wp-content/uploads/2018/01/WP-FinFisher.pdf}, language = {English}, urldate = {2020-01-13} } ESET’S GUIDE TODEOBFUSCATING AND DEVIRTUALIZING FINFISHER
FinFisher RAT
2018-01-23Möbius Strip Reverse EngineeringRolf Rolles
@online{rolles:20180123:walkthrough:afbbb08, author = {Rolf Rolles}, title = {{A Walk-Through Tutorial, with Code, on Statically Unpacking the FinSpy VM: Part One, x86 Deobfuscation}}, date = {2018-01-23}, organization = {Möbius Strip Reverse Engineering}, url = {http://www.msreverseengineering.com/blog/2018/1/23/a-walk-through-tutorial-with-code-on-statically-unpacking-the-finspy-vm-part-one-x86-deobfuscation}, language = {English}, urldate = {2020-01-08} } A Walk-Through Tutorial, with Code, on Statically Unpacking the FinSpy VM: Part One, x86 Deobfuscation
FinFisher RAT
2017-10-16Kaspersky LabsGReAT
@online{great:20171016:blackoasis:b447418, author = {GReAT}, title = {{BlackOasis APT and new targeted attacks leveraging zero-day exploit}}, date = {2017-10-16}, organization = {Kaspersky Labs}, url = {https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/}, language = {English}, urldate = {2019-12-20} } BlackOasis APT and new targeted attacks leveraging zero-day exploit
FinFisher RAT BlackOasis
2017-09-21ESET ResearchFilip Kafka
@online{kafka:20170921:new:8bcb309, author = {Filip Kafka}, title = {{New FinFisher surveillance campaigns: Internet providers involved?}}, date = {2017-09-21}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2017/09/21/new-finfisher-surveillance-campaigns/}, language = {English}, urldate = {2019-11-14} } New FinFisher surveillance campaigns: Internet providers involved?
FinFisher RAT
2017-09-12FireEyeBen Read, Genwei Jiang, James T. Bennett
@online{read:20170912:fireeye:60e2846, author = {Ben Read and Genwei Jiang and James T. Bennett}, title = {{FireEye Uncovers CVE-2017-8759: Zero-Day Used in the Wild to Distribute FINSPY,FireEye Uncovers CVE-2017-8759: Zero-Day Used in the Wild to Distribute FINSPY}}, date = {2017-09-12}, organization = {FireEye}, url = {https://www.fireeye.com/blog/threat-research/2017/09/zero-day-used-to-distribute-finspy.html}, language = {English}, urldate = {2019-12-20} } FireEye Uncovers CVE-2017-8759: Zero-Day Used in the Wild to Distribute FINSPY,FireEye Uncovers CVE-2017-8759: Zero-Day Used in the Wild to Distribute FINSPY
FinFisher RAT BlackOasis
2017-07-18ElasticAshkan Hosseini
@online{hosseini:20170718:ten:af036b3, author = {Ashkan Hosseini}, title = {{Ten process injection techniques: A technical survey of common and trending process injection techniques}}, date = {2017-07-18}, organization = {Elastic}, url = {https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process}, language = {English}, urldate = {2020-07-15} } Ten process injection techniques: A technical survey of common and trending process injection techniques
Cryakl CyberGate Dridex FinFisher RAT Locky
2017-01-13Artem Baranov
@online{baranov:20170113:finfisher:436b89e, author = {Artem Baranov}, title = {{Finfisher rootkit analysis}}, date = {2017-01-13}, url = {https://artemonsecurity.blogspot.de/2017/01/finfisher-rootkit-analysis.html}, language = {English}, urldate = {2019-11-26} } Finfisher rootkit analysis
FinFisher RAT
2014-10-02CodeAndSecCodeAndSec
@online{codeandsec:20141002:finfisher:3b1d9c1, author = {CodeAndSec}, title = {{FinFisher Malware Analysis - Part 2}}, date = {2014-10-02}, organization = {CodeAndSec}, url = {https://www.codeandsec.com/FinFisher-Malware-Analysis-Part-2}, language = {English}, urldate = {2020-03-19} } FinFisher Malware Analysis - Part 2
FinFisher RAT
Yara Rules
[TLP:WHITE] win_finfisher_auto (20201023 | autogenerated rule brought to you by yara-signator)
rule win_finfisher_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-12-22"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.finfisher"
        malpedia_rule_date = "20201222"
        malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130"
        malpedia_version = "20201023"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 56 8d85ccf9ffff 50 e8???????? }
            // n = 4, score = 200
            //   56                   | push                esi
            //   8d85ccf9ffff         | lea                 eax, [ebp - 0x634]
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_1 = { 68???????? 6804010000 8d85ccf9ffff 50 }
            // n = 4, score = 200
            //   68????????           |                     
            //   6804010000           | push                0x104
            //   8d85ccf9ffff         | lea                 eax, [ebp - 0x634]
            //   50                   | push                eax

        $sequence_2 = { 51 68a0208000 ff5020 8945dc }
            // n = 4, score = 100
            //   51                   | push                ecx
            //   68a0208000           | push                0x8020a0
            //   ff5020               | call                dword ptr [eax + 0x20]
            //   8945dc               | mov                 dword ptr [ebp - 0x24], eax

        $sequence_3 = { a1???????? ff5014 c785c89dffff0a000000 8b864c030000 }
            // n = 4, score = 100
            //   a1????????           |                     
            //   ff5014               | call                dword ptr [eax + 0x14]
            //   c785c89dffff0a000000     | mov    dword ptr [ebp - 0x6238], 0xa
            //   8b864c030000         | mov                 eax, dword ptr [esi + 0x34c]

        $sequence_4 = { 8bf8 8d85b0f9ffff 50 e8???????? 3bf8 7514 }
            // n = 6, score = 100
            //   8bf8                 | mov                 edi, eax
            //   8d85b0f9ffff         | lea                 eax, [ebp - 0x650]
            //   50                   | push                eax
            //   e8????????           |                     
            //   3bf8                 | cmp                 edi, eax
            //   7514                 | jne                 0x16

        $sequence_5 = { 50 ff15???????? c78578f7ffff18000000 89b57cf7ffff c78584f7ffff40000000 }
            // n = 5, score = 100
            //   50                   | push                eax
            //   ff15????????         |                     
            //   c78578f7ffff18000000     | mov    dword ptr [ebp - 0x888], 0x18
            //   89b57cf7ffff         | mov                 dword ptr [ebp - 0x884], esi
            //   c78584f7ffff40000000     | mov    dword ptr [ebp - 0x87c], 0x40

        $sequence_6 = { 57 33ff 397d08 0f84d6000000 397d0c 0f84cd000000 397d10 }
            // n = 7, score = 100
            //   57                   | push                edi
            //   33ff                 | xor                 edi, edi
            //   397d08               | cmp                 dword ptr [ebp + 8], edi
            //   0f84d6000000         | je                  0xdc
            //   397d0c               | cmp                 dword ptr [ebp + 0xc], edi
            //   0f84cd000000         | je                  0xd3
            //   397d10               | cmp                 dword ptr [ebp + 0x10], edi

        $sequence_7 = { c78584f7ffff40000000 8d854cf7ffff 898580f7ffff 89b588f7ffff 89b58cf7ffff 8b4718 3ddddddddd }
            // n = 7, score = 100
            //   c78584f7ffff40000000     | mov    dword ptr [ebp - 0x87c], 0x40
            //   8d854cf7ffff         | lea                 eax, [ebp - 0x8b4]
            //   898580f7ffff         | mov                 dword ptr [ebp - 0x880], eax
            //   89b588f7ffff         | mov                 dword ptr [ebp - 0x878], esi
            //   89b58cf7ffff         | mov                 dword ptr [ebp - 0x874], esi
            //   8b4718               | mov                 eax, dword ptr [edi + 0x18]
            //   3ddddddddd           | cmp                 eax, 0xdddddddd

        $sequence_8 = { 3bdf 740b ff75fc ff15???????? }
            // n = 4, score = 100
            //   3bdf                 | cmp                 ebx, edi
            //   740b                 | je                  0xd
            //   ff75fc               | push                dword ptr [ebp - 4]
            //   ff15????????         |                     

        $sequence_9 = { 0f8583030000 66c78572f7ffff0401 8d85dcfdffff 898574f7ffff 8d8548f7ffff 50 }
            // n = 6, score = 100
            //   0f8583030000         | jne                 0x389
            //   66c78572f7ffff0401     | mov    word ptr [ebp - 0x88e], 0x104
            //   8d85dcfdffff         | lea                 eax, [ebp - 0x224]
            //   898574f7ffff         | mov                 dword ptr [ebp - 0x88c], eax
            //   8d8548f7ffff         | lea                 eax, [ebp - 0x8b8]
            //   50                   | push                eax

        $sequence_10 = { 68400dfe00 8d85ccfbffff 50 a1???????? ff5018 8985d0fbffff 85c0 }
            // n = 7, score = 100
            //   68400dfe00           | push                0xfe0d40
            //   8d85ccfbffff         | lea                 eax, [ebp - 0x434]
            //   50                   | push                eax
            //   a1????????           |                     
            //   ff5018               | call                dword ptr [eax + 0x18]
            //   8985d0fbffff         | mov                 dword ptr [ebp - 0x430], eax
            //   85c0                 | test                eax, eax

        $sequence_11 = { 6a01 8d85e8fdffff 50 57 e8???????? 84c0 }
            // n = 6, score = 100
            //   6a01                 | push                1
            //   8d85e8fdffff         | lea                 eax, [ebp - 0x218]
            //   50                   | push                eax
            //   57                   | push                edi
            //   e8????????           |                     
            //   84c0                 | test                al, al

        $sequence_12 = { 57 50 68???????? a3???????? 893d???????? 893d???????? ff15???????? }
            // n = 7, score = 100
            //   57                   | push                edi
            //   50                   | push                eax
            //   68????????           |                     
            //   a3????????           |                     
            //   893d????????         |                     
            //   893d????????         |                     
            //   ff15????????         |                     

        $sequence_13 = { 33db 8975fc 8975f4 ff15???????? 3bc6 89450c }
            // n = 6, score = 100
            //   33db                 | xor                 ebx, ebx
            //   8975fc               | mov                 dword ptr [ebp - 4], esi
            //   8975f4               | mov                 dword ptr [ebp - 0xc], esi
            //   ff15????????         |                     
            //   3bc6                 | cmp                 eax, esi
            //   89450c               | mov                 dword ptr [ebp + 0xc], eax

    condition:
        7 of them and filesize < 262144
}
[TLP:WHITE] win_finfisher_w0   (20170517 | FinFisher FinSpy)
/*
    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.

*/

rule win_finfisher_w0 {
    meta:
        description = "FinFisher FinSpy"
	    author = "botherder https://github.com/botherder"
	    source = "https://github.com/mattulm/sfiles_yara/blob/master/malware/FinSpy.yar"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.finfisher"
        malpedia_version = "20170517"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $password1 = /\/scomma kbd101\.sys/ wide ascii
        $password2 = /(N)AME,EMAIL CLIENT,EMAIL ADDRESS,SERVER NAME,SERVER TYPE,USERNAME,PASSWORD,PROFILE/ wide ascii
        $password3 = /\/scomma excel2010\.part/ wide ascii
        $password4 = /(A)PPLICATION,PROTOCOL,USERNAME,PASSWORD/ wide ascii
        $password5 = /\/stab MSVCR32\.manifest/ wide ascii
        $password6 = /\/scomma MSN2010\.dll/ wide ascii
        $password7 = /\/scomma Firefox\.base/ wide ascii
        $password8 = /(I)NDEX,URL,USERNAME,PASSWORD,USERNAME FIELD,PASSWORD FIELD,FILE,HTTP/ wide ascii
        $password9 = /\/scomma IE7setup\.sys/ wide ascii
        $password10 = /(O)RIGIN URL,ACTION URL,USERNAME FIELD,PASSWORD FIELD,USERNAME,PASSWORD,TIMESTAMP/ wide ascii
        $password11 = /\/scomma office2007\.cab/ wide ascii
        $password12 = /(U)RL,PASSWORD TYPE,USERNAME,PASSWORD,USERNAME FIELD,PASSWORD FIELD/ wide ascii
        $password13 = /\/scomma outlook2007\.dll/ wide ascii
        $password14 = /(F)ILENAME,ENCRYPTION,VERSION,CRC,PASSWORD 1,PASSWORD 2,PASSWORD 3,PATH,SIZE,LAST MODIFICATION DATE,ERROR/ wide ascii

        $screenrec1 = /(s)111o00000000\.dat/ wide ascii
        $screenrec2 = /(t)111o00000000\.dat/ wide ascii
        $screenrec3 = /(f)113o00000000\.dat/ wide ascii
        $screenrec4 = /(w)114o00000000\.dat/ wide ascii
        $screenrec5 = /(u)112Q00000000\.dat/ wide ascii
        $screenrec6 = /(v)112Q00000000\.dat/ wide ascii
        $screenrec7 = /(v)112O00000000\.dat/ wide ascii

        //$keylogger1 = /\<%s UTC %s\|%d\|%s\>/ wide ascii
        //$keylogger2 = /1201[0-9A-F]{8}\.dat/ wide ascii

        $micrec = /2101[0-9A-F]{8}\.dat/ wide ascii

        $skyperec1 = /\[%19s\] %25s\:    %s/ wide ascii
        $skyperec2 = /Global\\\{A48F1A32\-A340\-11D0\-BC6B\-00A0C903%\.04X\}/ wide
        $skyperec3 = /(1411|1421|1431|1451)[0-9A-F]{8}\.dat/ wide ascii

        $mouserec1 = /(m)sc183Q000\.dat/ wide ascii
        $mouserec2 = /2201[0-9A-F]{8}\.dat/ wide ascii

        $driver = /\\\\\\\\\.\\\\driverw/ wide ascii

        $janedow1 = /(J)ane Dow\'s x32 machine/ wide ascii
        $janedow2 = /(J)ane Dow\'s x64 machine/ wide ascii

        $versions1 = /(f)inspyv2/ nocase
        $versions2 = /(f)inspyv4/ nocase

        $bootkit1 = /(b)ootkit_x32driver/
        $bootkit2 = /(b)ootkit_x64driver/

        $typo1 = /(S)creenShort Recording/ wide

        $mssounddx = /(S)ystem\\CurrentControlSet\\Services\\mssounddx/ wide

    condition:
        8 of ($password*) or any of ($screenrec*) or $micrec or any of ($skyperec*) or any of ($mouserec*) or $driver or any of ($janedow*) or any of ($versions*) or any of ($bootkit*) or $typo1 or $mssounddx
}
[TLP:WHITE] win_finfisher_w1   (20170517 | FinFisher FinSpy)
rule win_finfisher_w1 {
    meta:
        description = "FinFisher FinSpy"
        author = "AlienVault Labs"
	    source = "https://github.com/mattulm/sfiles_yara/blob/master/malware/FinSpy.yar"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.finfisher"
        malpedia_version = "20170517"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $filter1 = "$password14"
        $filter2 = "$screenrec7"
        $filter3 = "$micrec"
        $filter4 = "$skyperec3"
        $filter5 = "$mouserec2"
        $filter6 = "$driver"
        $filter7 = "$janedow2"
        $filter8 = "$bootkit2"

        $password1 = /\/scomma kbd101\.sys/ wide ascii
        $password2 = /(N)AME,EMAIL CLIENT,EMAIL ADDRESS,SERVER NAME,SERVER TYPE,USERNAME,PASSWORD,PROFILE/ wide ascii
        $password3 = /\/scomma excel2010\.part/ wide ascii
        $password4 = /(A)PPLICATION,PROTOCOL,USERNAME,PASSWORD/ wide ascii
        $password5 = /\/stab MSVCR32\.manifest/ wide ascii
        $password6 = /\/scomma MSN2010\.dll/ wide ascii
        $password7 = /\/scomma Firefox\.base/ wide ascii
        $password8 = /(I)NDEX,URL,USERNAME,PASSWORD,USERNAME FIELD,PASSWORD FIELD,FILE,HTTP/ wide ascii
        $password9 = /\/scomma IE7setup\.sys/ wide ascii
        $password10 = /(O)RIGIN URL,ACTION URL,USERNAME FIELD,PASSWORD FIELD,USERNAME,PASSWORD,TIMESTAMP/ wide ascii
        $password11 = /\/scomma office2007\.cab/ wide ascii
        $password12 = /(U)RL,PASSWORD TYPE,USERNAME,PASSWORD,USERNAME FIELD,PASSWORD FIELD/ wide ascii
        $password13 = /\/scomma outlook2007\.dll/ wide ascii
        $password14 = /(F)ILENAME,ENCRYPTION,VERSION,CRC,PASSWORD 1,PASSWORD 2,PASSWORD 3,PATH,SIZE,LAST MODIFICATION DATE,ERROR/ wide ascii

        $screenrec1 = /(s)111o00000000\.dat/ wide ascii
        $screenrec2 = /(t)111o00000000\.dat/ wide ascii
        $screenrec3 = /(f)113o00000000\.dat/ wide ascii
        $screenrec4 = /(w)114o00000000\.dat/ wide ascii
        $screenrec5 = /(u)112Q00000000\.dat/ wide ascii
        $screenrec6 = /(v)112Q00000000\.dat/ wide ascii
        $screenrec7 = /(v)112O00000000\.dat/ wide ascii

        //$keylogger1 = /\<%s UTC %s\|%d\|%s\>/ wide ascii
        //$keylogger2 = /1201[0-9A-F]{8}\.dat/ wide ascii

        $micrec = /2101[0-9A-F]{8}\.dat/ wide ascii

        $skyperec1 = /\[%19s\] %25s\:    %s/ wide ascii
        $skyperec2 = /Global\\\{A48F1A32\-A340\-11D0\-BC6B\-00A0C903%\.04X\}/ wide
        //$skyperec3 = /(1411|1421|1431|1451)[0-9A-F]{8}\.dat/ wide ascii

        //$mouserec1 = /(m)sc183Q000\.dat/ wide ascii
        //$mouserec2 = /2201[0-9A-F]{8}\.dat/ wide ascii

        $driver = /\\\\\\\\\.\\\\driverw/ wide ascii

        $janedow1 = /(J)ane Dow\'s x32 machine/ wide ascii
        $janedow2 = /(J)ane Dow\'s x64 machine/ wide ascii

        //$versions1 = /(f)inspyv2/ nocase
        //$versions2 = /(f)inspyv4/ nocase

        $bootkit1 = /(b)ootkit_x32driver/
        $bootkit2 = /(b)ootkit_x64driver/

        $typo1 = /(S)creenShort Recording/ wide

        $mssounddx = /(S)ystem\\CurrentControlSet\\Services\\mssounddx/ wide

    condition:
        (8 of ($password*) or any of ($screenrec*) or $micrec or any of ($skyperec*) or $driver or any of ($janedow*) or any of ($bootkit*) or $typo1 or $mssounddx) and not any of ($filter*)
}
Download all Yara Rules