FinFisher RAT (Malware Family)

FinFisher RAT

aka: FinSpy

VTCollection

FinFisher is a commercial software used to steal information and spy on affected victims. It began with few functionalities which included password harvesting and information leakage, but now it is mostly known for its full Remote Access Trojan (RAT) capabilities. It is mostly known for being used in governmental targeted and lawful criminal investigations. It is well known for its anti-detection capabilities and use of VMProtect.

References

2017-09-12 ⋅ FireEye ⋅ Ben Read, Genwei Jiang, James T. Bennett
FireEye Uncovers CVE-2017-8759: Zero-Day Used in the Wild to Distribute FINSPY,FireEye Uncovers CVE-2017-8759: Zero-Day Used in the Wild to Distribute FINSPY
FinFisher RAT BlackOasis

Yara Rules

[TLP:WHITE] win_finfisher_auto (20260504 | Detects win.finfisher.)

rule win_finfisher_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.finfisher."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.finfisher"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 57 56 8d85ccf9ffff 50 e8???????? }
            // n = 5, score = 200
            //   57                   | push                edi
            //   56                   | push                esi
            //   8d85ccf9ffff         | lea                 eax, [ebp - 0x634]
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_1 = { 68???????? 6804010000 8d85ccf9ffff 50 }
            // n = 4, score = 200
            //   68????????           |                     
            //   6804010000           | push                0x104
            //   8d85ccf9ffff         | lea                 eax, [ebp - 0x634]
            //   50                   | push                eax

        $sequence_2 = { 8b4710 c1e009 50 ffb5b4f7ffff ffb5c0f7ffff }
            // n = 5, score = 100
            //   8b4710               | mov                 eax, dword ptr [edi + 0x10]
            //   c1e009               | shl                 eax, 9
            //   50                   | push                eax
            //   ffb5b4f7ffff         | push                dword ptr [ebp - 0x84c]
            //   ffb5c0f7ffff         | push                dword ptr [ebp - 0x840]

        $sequence_3 = { eb3e e8???????? e8???????? 85c0 a1???????? }
            // n = 5, score = 100
            //   eb3e                 | jmp                 0x40
            //   e8????????           |                     
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   a1????????           |                     

        $sequence_4 = { ff5604 8b3b 8b5b10 8945fc 8b4610 }
            // n = 5, score = 100
            //   ff5604               | call                dword ptr [esi + 4]
            //   8b3b                 | mov                 edi, dword ptr [ebx]
            //   8b5b10               | mov                 ebx, dword ptr [ebx + 0x10]
            //   8945fc               | mov                 dword ptr [ebp - 4], eax
            //   8b4610               | mov                 eax, dword ptr [esi + 0x10]

        $sequence_5 = { 0f842d010000 8d85dcfdffff 8d5002 668b08 40 40 663bce }
            // n = 7, score = 100
            //   0f842d010000         | je                  0x133
            //   8d85dcfdffff         | lea                 eax, [ebp - 0x224]
            //   8d5002               | lea                 edx, [eax + 2]
            //   668b08               | mov                 cx, word ptr [eax]
            //   40                   | inc                 eax
            //   40                   | inc                 eax
            //   663bce               | cmp                 cx, si

        $sequence_6 = { 740e 3daaaaaaaa 7407 3ddddddddd }
            // n = 4, score = 100
            //   740e                 | je                  0x10
            //   3daaaaaaaa           | cmp                 eax, 0xaaaaaaaa
            //   7407                 | je                  9
            //   3ddddddddd           | cmp                 eax, 0xdddddddd

        $sequence_7 = { ffb598edffff ff15???????? 89bd98edffff c3 }
            // n = 4, score = 100
            //   ffb598edffff         | push                dword ptr [ebp - 0x1268]
            //   ff15????????         |                     
            //   89bd98edffff         | mov                 dword ptr [ebp - 0x1268], edi
            //   c3                   | ret                 

        $sequence_8 = { ffb5b4f7ffff ffb5c0f7ffff 33c0 397714 0f95c0 83c003 }
            // n = 6, score = 100
            //   ffb5b4f7ffff         | push                dword ptr [ebp - 0x84c]
            //   ffb5c0f7ffff         | push                dword ptr [ebp - 0x840]
            //   33c0                 | xor                 eax, eax
            //   397714               | cmp                 dword ptr [edi + 0x14], esi
            //   0f95c0               | setne               al
            //   83c003               | add                 eax, 3

        $sequence_9 = { 8b4dd8 8b01 83e808 50 83c108 }
            // n = 5, score = 100
            //   8b4dd8               | mov                 ecx, dword ptr [ebp - 0x28]
            //   8b01                 | mov                 eax, dword ptr [ecx]
            //   83e808               | sub                 eax, 8
            //   50                   | push                eax
            //   83c108               | add                 ecx, 8

        $sequence_10 = { ff15???????? 8d8594f7ffff 50 8d855cf7ffff }
            // n = 4, score = 100
            //   ff15????????         |                     
            //   8d8594f7ffff         | lea                 eax, [ebp - 0x86c]
            //   50                   | push                eax
            //   8d855cf7ffff         | lea                 eax, [ebp - 0x8a4]

        $sequence_11 = { 8945e4 3bc6 7409 c745e40c000000 eb54 }
            // n = 5, score = 100
            //   8945e4               | mov                 dword ptr [ebp - 0x1c], eax
            //   3bc6                 | cmp                 eax, esi
            //   7409                 | je                  0xb
            //   c745e40c000000       | mov                 dword ptr [ebp - 0x1c], 0xc
            //   eb54                 | jmp                 0x56

        $sequence_12 = { b8???????? e8???????? 33f6 46 3bc6 }
            // n = 5, score = 100
            //   b8????????           |                     
            //   e8????????           |                     
            //   33f6                 | xor                 esi, esi
            //   46                   | inc                 esi
            //   3bc6                 | cmp                 eax, esi

        $sequence_13 = { c78578f7ffff18000000 89b57cf7ffff c78584f7ffff40020000 8d8570f7ffff 898580f7ffff 89b588f7ffff 89b58cf7ffff }
            // n = 7, score = 100
            //   c78578f7ffff18000000     | mov    dword ptr [ebp - 0x888], 0x18
            //   89b57cf7ffff         | mov                 dword ptr [ebp - 0x884], esi
            //   c78584f7ffff40020000     | mov    dword ptr [ebp - 0x87c], 0x240
            //   8d8570f7ffff         | lea                 eax, [ebp - 0x890]
            //   898580f7ffff         | mov                 dword ptr [ebp - 0x880], eax
            //   89b588f7ffff         | mov                 dword ptr [ebp - 0x878], esi
            //   89b58cf7ffff         | mov                 dword ptr [ebp - 0x874], esi

    condition:
        7 of them and filesize < 262144
}

[TLP:WHITE] win_finfisher_w0 (20170517 | FinFisher FinSpy)

/*
    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.

*/

rule win_finfisher_w0 {
    meta:
        description = "FinFisher FinSpy"
	    author = "botherder https://github.com/botherder"
	    source = "https://github.com/mattulm/sfiles_yara/blob/master/malware/FinSpy.yar"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.finfisher"
        malpedia_version = "20170517"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $password1 = /\/scomma kbd101\.sys/ wide ascii
        $password2 = /(N)AME,EMAIL CLIENT,EMAIL ADDRESS,SERVER NAME,SERVER TYPE,USERNAME,PASSWORD,PROFILE/ wide ascii
        $password3 = /\/scomma excel2010\.part/ wide ascii
        $password4 = /(A)PPLICATION,PROTOCOL,USERNAME,PASSWORD/ wide ascii
        $password5 = /\/stab MSVCR32\.manifest/ wide ascii
        $password6 = /\/scomma MSN2010\.dll/ wide ascii
        $password7 = /\/scomma Firefox\.base/ wide ascii
        $password8 = /(I)NDEX,URL,USERNAME,PASSWORD,USERNAME FIELD,PASSWORD FIELD,FILE,HTTP/ wide ascii
        $password9 = /\/scomma IE7setup\.sys/ wide ascii
        $password10 = /(O)RIGIN URL,ACTION URL,USERNAME FIELD,PASSWORD FIELD,USERNAME,PASSWORD,TIMESTAMP/ wide ascii
        $password11 = /\/scomma office2007\.cab/ wide ascii
        $password12 = /(U)RL,PASSWORD TYPE,USERNAME,PASSWORD,USERNAME FIELD,PASSWORD FIELD/ wide ascii
        $password13 = /\/scomma outlook2007\.dll/ wide ascii
        $password14 = /(F)ILENAME,ENCRYPTION,VERSION,CRC,PASSWORD 1,PASSWORD 2,PASSWORD 3,PATH,SIZE,LAST MODIFICATION DATE,ERROR/ wide ascii

        $screenrec1 = /(s)111o00000000\.dat/ wide ascii
        $screenrec2 = /(t)111o00000000\.dat/ wide ascii
        $screenrec3 = /(f)113o00000000\.dat/ wide ascii
        $screenrec4 = /(w)114o00000000\.dat/ wide ascii
        $screenrec5 = /(u)112Q00000000\.dat/ wide ascii
        $screenrec6 = /(v)112Q00000000\.dat/ wide ascii
        $screenrec7 = /(v)112O00000000\.dat/ wide ascii

        //$keylogger1 = /\<%s UTC %s\|%d\|%s\>/ wide ascii
        //$keylogger2 = /1201[0-9A-F]{8}\.dat/ wide ascii

        $micrec = /2101[0-9A-F]{8}\.dat/ wide ascii

        $skyperec1 = /\[%19s\] %25s\:    %s/ wide ascii
        $skyperec2 = /Global\\\{A48F1A32\-A340\-11D0\-BC6B\-00A0C903%\.04X\}/ wide
        $skyperec3 = /(1411|1421|1431|1451)[0-9A-F]{8}\.dat/ wide ascii

        $mouserec1 = /(m)sc183Q000\.dat/ wide ascii
        $mouserec2 = /2201[0-9A-F]{8}\.dat/ wide ascii

        $driver = /\\\\\\\\\.\\\\driverw/ wide ascii

        $janedow1 = /(J)ane Dow\'s x32 machine/ wide ascii
        $janedow2 = /(J)ane Dow\'s x64 machine/ wide ascii

        $versions1 = /(f)inspyv2/ nocase
        $versions2 = /(f)inspyv4/ nocase

        $bootkit1 = /(b)ootkit_x32driver/
        $bootkit2 = /(b)ootkit_x64driver/

        $typo1 = /(S)creenShort Recording/ wide

        $mssounddx = /(S)ystem\\CurrentControlSet\\Services\\mssounddx/ wide

    condition:
        8 of ($password*) or any of ($screenrec*) or $micrec or any of ($skyperec*) or any of ($mouserec*) or $driver or any of ($janedow*) or any of ($versions*) or any of ($bootkit*) or $typo1 or $mssounddx
}

[TLP:WHITE] win_finfisher_w1 (20170517 | FinFisher FinSpy)

rule win_finfisher_w1 {
    meta:
        description = "FinFisher FinSpy"
        author = "AlienVault Labs"
	    source = "https://github.com/mattulm/sfiles_yara/blob/master/malware/FinSpy.yar"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.finfisher"
        malpedia_version = "20170517"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $filter1 = "$password14"
        $filter2 = "$screenrec7"
        $filter3 = "$micrec"
        $filter4 = "$skyperec3"
        $filter5 = "$mouserec2"
        $filter6 = "$driver"
        $filter7 = "$janedow2"
        $filter8 = "$bootkit2"

        $password1 = /\/scomma kbd101\.sys/ wide ascii
        $password2 = /(N)AME,EMAIL CLIENT,EMAIL ADDRESS,SERVER NAME,SERVER TYPE,USERNAME,PASSWORD,PROFILE/ wide ascii
        $password3 = /\/scomma excel2010\.part/ wide ascii
        $password4 = /(A)PPLICATION,PROTOCOL,USERNAME,PASSWORD/ wide ascii
        $password5 = /\/stab MSVCR32\.manifest/ wide ascii
        $password6 = /\/scomma MSN2010\.dll/ wide ascii
        $password7 = /\/scomma Firefox\.base/ wide ascii
        $password8 = /(I)NDEX,URL,USERNAME,PASSWORD,USERNAME FIELD,PASSWORD FIELD,FILE,HTTP/ wide ascii
        $password9 = /\/scomma IE7setup\.sys/ wide ascii
        $password10 = /(O)RIGIN URL,ACTION URL,USERNAME FIELD,PASSWORD FIELD,USERNAME,PASSWORD,TIMESTAMP/ wide ascii
        $password11 = /\/scomma office2007\.cab/ wide ascii
        $password12 = /(U)RL,PASSWORD TYPE,USERNAME,PASSWORD,USERNAME FIELD,PASSWORD FIELD/ wide ascii
        $password13 = /\/scomma outlook2007\.dll/ wide ascii
        $password14 = /(F)ILENAME,ENCRYPTION,VERSION,CRC,PASSWORD 1,PASSWORD 2,PASSWORD 3,PATH,SIZE,LAST MODIFICATION DATE,ERROR/ wide ascii

        $screenrec1 = /(s)111o00000000\.dat/ wide ascii
        $screenrec2 = /(t)111o00000000\.dat/ wide ascii
        $screenrec3 = /(f)113o00000000\.dat/ wide ascii
        $screenrec4 = /(w)114o00000000\.dat/ wide ascii
        $screenrec5 = /(u)112Q00000000\.dat/ wide ascii
        $screenrec6 = /(v)112Q00000000\.dat/ wide ascii
        $screenrec7 = /(v)112O00000000\.dat/ wide ascii

        //$keylogger1 = /\<%s UTC %s\|%d\|%s\>/ wide ascii
        //$keylogger2 = /1201[0-9A-F]{8}\.dat/ wide ascii

        $micrec = /2101[0-9A-F]{8}\.dat/ wide ascii

        $skyperec1 = /\[%19s\] %25s\:    %s/ wide ascii
        $skyperec2 = /Global\\\{A48F1A32\-A340\-11D0\-BC6B\-00A0C903%\.04X\}/ wide
        //$skyperec3 = /(1411|1421|1431|1451)[0-9A-F]{8}\.dat/ wide ascii

        //$mouserec1 = /(m)sc183Q000\.dat/ wide ascii
        //$mouserec2 = /2201[0-9A-F]{8}\.dat/ wide ascii

        $driver = /\\\\\\\\\.\\\\driverw/ wide ascii

        $janedow1 = /(J)ane Dow\'s x32 machine/ wide ascii
        $janedow2 = /(J)ane Dow\'s x64 machine/ wide ascii

        //$versions1 = /(f)inspyv2/ nocase
        //$versions2 = /(f)inspyv4/ nocase

        $bootkit1 = /(b)ootkit_x32driver/
        $bootkit2 = /(b)ootkit_x64driver/

        $typo1 = /(S)creenShort Recording/ wide

        $mssounddx = /(S)ystem\\CurrentControlSet\\Services\\mssounddx/ wide

    condition:
        (8 of ($password*) or any of ($screenrec*) or $micrec or any of ($skyperec*) or $driver or any of ($janedow*) or any of ($bootkit*) or $typo1 or $mssounddx) and not any of ($filter*)
}

Download all Yara Rules

FinFisher RAT Propose Change

References

Yara Rules

FinFisher RAT