SYMBOLCOMMON_NAMEaka. SYNONYMS
win.finfisher (Back to overview)

FinFisher RAT

aka: FinSpy
VTCollection    

FinFisher is a commercial software used to steal information and spy on affected victims. It began with few functionalities which included password harvesting and information leakage, but now it is mostly known for its full Remote Access Trojan (RAT) capabilities. It is mostly known for being used in governmental targeted and lawful criminal investigations. It is well known for its anti-detection capabilities and use of VMProtect.

References
2022-03-28Netzpolitik.orgAndre Meister
Staatstrojaner-Hersteller FinFisher „ist geschlossen und bleibt es auch“
FinFisher RAT
2021-11-15binarlyBinarly Team
Design issues of modern EDRs: bypassing ETW-based solutions
ESPecter FinFisher RAT
2021-09-28Kaspersky LabsGReAT
FinSpy: unseen findings
FinFisher FinFisher FinFisher FinFisher RAT
2021-03-21BlackberryBlackberry Research
2021 Threat Report
Bashlite FritzFrog IPStorm Mirai Tsunami elf.wellmess AppleJeus Dacls EvilQuest Manuscrypt Astaroth BazarBackdoor Cerber Cobalt Strike Emotet FinFisher RAT Kwampirs MimiKatz NjRAT Ryuk SmokeLoader TrickBot
2020-10-14Netzpolitik.orgAndre Meister
German Made State Malware Company FinFisher Raided
FinFisher FinFisher FinFisher FinFisher RAT
2020-09-25Amnesty InternationalAmnesty International
German-made FinSpy spyware found in Egypt, and Mac and Linux versions revealed
FinFisher FinFisher FinFisher FinFisher RAT
2019-08-01Kaspersky LabsGReAT
APT trends report Q2 2019
ZooPark magecart POWERSTATS Chaperone COMpfun EternalPetya FinFisher RAT HawkEye Keylogger HOPLIGHT Microcin NjRAT Olympic Destroyer PLEAD RokRAT Triton Zebrocy
2018-03-01MicrosoftMicrosoft Defender ATP Research Team, Office 365 Threat Research Team
FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines
FinFisher RAT
2018-02-21Möbius Strip Reverse EngineeringRolf Rolles
FinSpy VM Unpacking Tutorial Part 3: Devirtualization. Phase #3: Fixing The Function-Related Issues
FinFisher RAT
2018-02-21Möbius Strip Reverse EngineeringRolf Rolles
FinSpy VM Unpacking Tutorial Part 3: Devirtualization. Phase #2: First Attempt At Devirtualization
FinFisher RAT
2018-02-21Möbius Strip Reverse EngineeringRolf Rolles
FinSpy VM Unpacking Tutorial Part 3: Devirtualization. Phase #1: Deobfuscating FinSpy VM Bytecode Programs
FinFisher RAT
2018-02-21Möbius Strip Reverse EngineeringRolf Rolles
FinSpy VM Unpacking Tutorial Part 3: Devirtualization. Phase #4: Second Attempt At Devirtualization
FinFisher RAT
2018-02-21Möbius Strip Reverse EngineeringRolf Rolles
FinSpy VM Unpacking Tutorial Part 3: Devirtualization
FinFisher RAT
2018-02-21GitHub (RolfRolles)Rolf Rolles
FinSpyVM (Static Unpacker for FinSpyVM)
FinFisher RAT
2018-01-24ESET ResearchFilip Kafka
ESET’S GUIDE TODEOBFUSCATING AND DEVIRTUALIZING FINFISHER
FinFisher RAT
2018-01-23Möbius Strip Reverse EngineeringRolf Rolles
A Walk-Through Tutorial, with Code, on Statically Unpacking the FinSpy VM: Part One, x86 Deobfuscation
FinFisher RAT
2017-10-16Kaspersky LabsGReAT
BlackOasis APT and new targeted attacks leveraging zero-day exploit
FinFisher RAT BlackOasis
2017-09-21ESET ResearchFilip Kafka
New FinFisher surveillance campaigns: Internet providers involved?
FinFisher RAT
2017-09-12FireEyeBen Read, Genwei Jiang, James T. Bennett
FireEye Uncovers CVE-2017-8759: Zero-Day Used in the Wild to Distribute FINSPY,FireEye Uncovers CVE-2017-8759: Zero-Day Used in the Wild to Distribute FINSPY
FinFisher RAT BlackOasis
2017-07-18ElasticAshkan Hosseini
Ten process injection techniques: A technical survey of common and trending process injection techniques
Cryakl CyberGate Dridex FinFisher RAT Locky
2017-01-13Artem Baranov
Finfisher rootkit analysis
FinFisher RAT
2014-10-02CodeAndSecCodeAndSec
FinFisher Malware Analysis - Part 2
FinFisher RAT
Yara Rules
[TLP:WHITE] win_finfisher_auto (20230808 | Detects win.finfisher.)
rule win_finfisher_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.finfisher."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.finfisher"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 68???????? 6804010000 8d85ccf9ffff 50 }
            // n = 4, score = 200
            //   68????????           |                     
            //   6804010000           | push                0x104
            //   8d85ccf9ffff         | lea                 eax, [ebp - 0x634]
            //   50                   | push                eax

        $sequence_1 = { 56 8d85ccf9ffff 50 e8???????? }
            // n = 4, score = 200
            //   56                   | push                esi
            //   8d85ccf9ffff         | lea                 eax, [ebp - 0x634]
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_2 = { 6a20 6a03 8d8594f7ffff 50 8d8578f7ffff 50 68000000c0 }
            // n = 7, score = 100
            //   6a20                 | push                0x20
            //   6a03                 | push                3
            //   8d8594f7ffff         | lea                 eax, [ebp - 0x86c]
            //   50                   | push                eax
            //   8d8578f7ffff         | lea                 eax, [ebp - 0x888]
            //   50                   | push                eax
            //   68000000c0           | push                0xc0000000

        $sequence_3 = { 663bc1 7506 8345e404 ebd8 }
            // n = 4, score = 100
            //   663bc1               | cmp                 ax, cx
            //   7506                 | jne                 8
            //   8345e404             | add                 dword ptr [ebp - 0x1c], 4
            //   ebd8                 | jmp                 0xffffffda

        $sequence_4 = { 0f853affffff c785d0fbffffd5d8ffff e9???????? 8b07 83e808 }
            // n = 5, score = 100
            //   0f853affffff         | jne                 0xffffff40
            //   c785d0fbffffd5d8ffff     | mov    dword ptr [ebp - 0x430], 0xffffd8d5
            //   e9????????           |                     
            //   8b07                 | mov                 eax, dword ptr [edi]
            //   83e808               | sub                 eax, 8

        $sequence_5 = { 52 68a0608000 eb11 8b4708 8b4dd4 }
            // n = 5, score = 100
            //   52                   | push                edx
            //   68a0608000           | push                0x8060a0
            //   eb11                 | jmp                 0x13
            //   8b4708               | mov                 eax, dword ptr [edi + 8]
            //   8b4dd4               | mov                 ecx, dword ptr [ebp - 0x2c]

        $sequence_6 = { 397714 7403 56 eb02 6a02 56 50 }
            // n = 7, score = 100
            //   397714               | cmp                 dword ptr [edi + 0x14], esi
            //   7403                 | je                  5
            //   56                   | push                esi
            //   eb02                 | jmp                 4
            //   6a02                 | push                2
            //   56                   | push                esi
            //   50                   | push                eax

        $sequence_7 = { e8???????? 56 e8???????? 8b861c030000 3d10270000 }
            // n = 5, score = 100
            //   e8????????           |                     
            //   56                   | push                esi
            //   e8????????           |                     
            //   8b861c030000         | mov                 eax, dword ptr [esi + 0x31c]
            //   3d10270000           | cmp                 eax, 0x2710

        $sequence_8 = { 56 8d859cf7ffff 50 56 a1???????? }
            // n = 5, score = 100
            //   56                   | push                esi
            //   8d859cf7ffff         | lea                 eax, [ebp - 0x864]
            //   50                   | push                eax
            //   56                   | push                esi
            //   a1????????           |                     

        $sequence_9 = { 85db 7424 8b17 8d448614 8b08 }
            // n = 5, score = 100
            //   85db                 | test                ebx, ebx
            //   7424                 | je                  0x26
            //   8b17                 | mov                 edx, dword ptr [edi]
            //   8d448614             | lea                 eax, [esi + eax*4 + 0x14]
            //   8b08                 | mov                 ecx, dword ptr [eax]

        $sequence_10 = { e9???????? 8b859cf7ffff ff7004 ff15???????? 8985c0f7ffff 8b8d9cf7ffff }
            // n = 6, score = 100
            //   e9????????           |                     
            //   8b859cf7ffff         | mov                 eax, dword ptr [ebp - 0x864]
            //   ff7004               | push                dword ptr [eax + 4]
            //   ff15????????         |                     
            //   8985c0f7ffff         | mov                 dword ptr [ebp - 0x840], eax
            //   8b8d9cf7ffff         | mov                 ecx, dword ptr [ebp - 0x864]

        $sequence_11 = { 6a09 ff15???????? 3bc6 7490 8bd0 }
            // n = 5, score = 100
            //   6a09                 | push                9
            //   ff15????????         |                     
            //   3bc6                 | cmp                 eax, esi
            //   7490                 | je                  0xffffff92
            //   8bd0                 | mov                 edx, eax

        $sequence_12 = { ffb5b8f7ffff eb5f 8d8578f7ffff 50 6a01 8d85acf7ffff }
            // n = 6, score = 100
            //   ffb5b8f7ffff         | push                dword ptr [ebp - 0x848]
            //   eb5f                 | jmp                 0x61
            //   8d8578f7ffff         | lea                 eax, [ebp - 0x888]
            //   50                   | push                eax
            //   6a01                 | push                1
            //   8d85acf7ffff         | lea                 eax, [ebp - 0x854]

        $sequence_13 = { 8d85acfbffff 50 53 56 }
            // n = 4, score = 100
            //   8d85acfbffff         | lea                 eax, [ebp - 0x454]
            //   50                   | push                eax
            //   53                   | push                ebx
            //   56                   | push                esi

    condition:
        7 of them and filesize < 262144
}
[TLP:WHITE] win_finfisher_w0   (20170517 | FinFisher FinSpy)
/*
    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.

*/

rule win_finfisher_w0 {
    meta:
        description = "FinFisher FinSpy"
	    author = "botherder https://github.com/botherder"
	    source = "https://github.com/mattulm/sfiles_yara/blob/master/malware/FinSpy.yar"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.finfisher"
        malpedia_version = "20170517"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $password1 = /\/scomma kbd101\.sys/ wide ascii
        $password2 = /(N)AME,EMAIL CLIENT,EMAIL ADDRESS,SERVER NAME,SERVER TYPE,USERNAME,PASSWORD,PROFILE/ wide ascii
        $password3 = /\/scomma excel2010\.part/ wide ascii
        $password4 = /(A)PPLICATION,PROTOCOL,USERNAME,PASSWORD/ wide ascii
        $password5 = /\/stab MSVCR32\.manifest/ wide ascii
        $password6 = /\/scomma MSN2010\.dll/ wide ascii
        $password7 = /\/scomma Firefox\.base/ wide ascii
        $password8 = /(I)NDEX,URL,USERNAME,PASSWORD,USERNAME FIELD,PASSWORD FIELD,FILE,HTTP/ wide ascii
        $password9 = /\/scomma IE7setup\.sys/ wide ascii
        $password10 = /(O)RIGIN URL,ACTION URL,USERNAME FIELD,PASSWORD FIELD,USERNAME,PASSWORD,TIMESTAMP/ wide ascii
        $password11 = /\/scomma office2007\.cab/ wide ascii
        $password12 = /(U)RL,PASSWORD TYPE,USERNAME,PASSWORD,USERNAME FIELD,PASSWORD FIELD/ wide ascii
        $password13 = /\/scomma outlook2007\.dll/ wide ascii
        $password14 = /(F)ILENAME,ENCRYPTION,VERSION,CRC,PASSWORD 1,PASSWORD 2,PASSWORD 3,PATH,SIZE,LAST MODIFICATION DATE,ERROR/ wide ascii

        $screenrec1 = /(s)111o00000000\.dat/ wide ascii
        $screenrec2 = /(t)111o00000000\.dat/ wide ascii
        $screenrec3 = /(f)113o00000000\.dat/ wide ascii
        $screenrec4 = /(w)114o00000000\.dat/ wide ascii
        $screenrec5 = /(u)112Q00000000\.dat/ wide ascii
        $screenrec6 = /(v)112Q00000000\.dat/ wide ascii
        $screenrec7 = /(v)112O00000000\.dat/ wide ascii

        //$keylogger1 = /\<%s UTC %s\|%d\|%s\>/ wide ascii
        //$keylogger2 = /1201[0-9A-F]{8}\.dat/ wide ascii

        $micrec = /2101[0-9A-F]{8}\.dat/ wide ascii

        $skyperec1 = /\[%19s\] %25s\:    %s/ wide ascii
        $skyperec2 = /Global\\\{A48F1A32\-A340\-11D0\-BC6B\-00A0C903%\.04X\}/ wide
        $skyperec3 = /(1411|1421|1431|1451)[0-9A-F]{8}\.dat/ wide ascii

        $mouserec1 = /(m)sc183Q000\.dat/ wide ascii
        $mouserec2 = /2201[0-9A-F]{8}\.dat/ wide ascii

        $driver = /\\\\\\\\\.\\\\driverw/ wide ascii

        $janedow1 = /(J)ane Dow\'s x32 machine/ wide ascii
        $janedow2 = /(J)ane Dow\'s x64 machine/ wide ascii

        $versions1 = /(f)inspyv2/ nocase
        $versions2 = /(f)inspyv4/ nocase

        $bootkit1 = /(b)ootkit_x32driver/
        $bootkit2 = /(b)ootkit_x64driver/

        $typo1 = /(S)creenShort Recording/ wide

        $mssounddx = /(S)ystem\\CurrentControlSet\\Services\\mssounddx/ wide

    condition:
        8 of ($password*) or any of ($screenrec*) or $micrec or any of ($skyperec*) or any of ($mouserec*) or $driver or any of ($janedow*) or any of ($versions*) or any of ($bootkit*) or $typo1 or $mssounddx
}
[TLP:WHITE] win_finfisher_w1   (20170517 | FinFisher FinSpy)
rule win_finfisher_w1 {
    meta:
        description = "FinFisher FinSpy"
        author = "AlienVault Labs"
	    source = "https://github.com/mattulm/sfiles_yara/blob/master/malware/FinSpy.yar"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.finfisher"
        malpedia_version = "20170517"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $filter1 = "$password14"
        $filter2 = "$screenrec7"
        $filter3 = "$micrec"
        $filter4 = "$skyperec3"
        $filter5 = "$mouserec2"
        $filter6 = "$driver"
        $filter7 = "$janedow2"
        $filter8 = "$bootkit2"

        $password1 = /\/scomma kbd101\.sys/ wide ascii
        $password2 = /(N)AME,EMAIL CLIENT,EMAIL ADDRESS,SERVER NAME,SERVER TYPE,USERNAME,PASSWORD,PROFILE/ wide ascii
        $password3 = /\/scomma excel2010\.part/ wide ascii
        $password4 = /(A)PPLICATION,PROTOCOL,USERNAME,PASSWORD/ wide ascii
        $password5 = /\/stab MSVCR32\.manifest/ wide ascii
        $password6 = /\/scomma MSN2010\.dll/ wide ascii
        $password7 = /\/scomma Firefox\.base/ wide ascii
        $password8 = /(I)NDEX,URL,USERNAME,PASSWORD,USERNAME FIELD,PASSWORD FIELD,FILE,HTTP/ wide ascii
        $password9 = /\/scomma IE7setup\.sys/ wide ascii
        $password10 = /(O)RIGIN URL,ACTION URL,USERNAME FIELD,PASSWORD FIELD,USERNAME,PASSWORD,TIMESTAMP/ wide ascii
        $password11 = /\/scomma office2007\.cab/ wide ascii
        $password12 = /(U)RL,PASSWORD TYPE,USERNAME,PASSWORD,USERNAME FIELD,PASSWORD FIELD/ wide ascii
        $password13 = /\/scomma outlook2007\.dll/ wide ascii
        $password14 = /(F)ILENAME,ENCRYPTION,VERSION,CRC,PASSWORD 1,PASSWORD 2,PASSWORD 3,PATH,SIZE,LAST MODIFICATION DATE,ERROR/ wide ascii

        $screenrec1 = /(s)111o00000000\.dat/ wide ascii
        $screenrec2 = /(t)111o00000000\.dat/ wide ascii
        $screenrec3 = /(f)113o00000000\.dat/ wide ascii
        $screenrec4 = /(w)114o00000000\.dat/ wide ascii
        $screenrec5 = /(u)112Q00000000\.dat/ wide ascii
        $screenrec6 = /(v)112Q00000000\.dat/ wide ascii
        $screenrec7 = /(v)112O00000000\.dat/ wide ascii

        //$keylogger1 = /\<%s UTC %s\|%d\|%s\>/ wide ascii
        //$keylogger2 = /1201[0-9A-F]{8}\.dat/ wide ascii

        $micrec = /2101[0-9A-F]{8}\.dat/ wide ascii

        $skyperec1 = /\[%19s\] %25s\:    %s/ wide ascii
        $skyperec2 = /Global\\\{A48F1A32\-A340\-11D0\-BC6B\-00A0C903%\.04X\}/ wide
        //$skyperec3 = /(1411|1421|1431|1451)[0-9A-F]{8}\.dat/ wide ascii

        //$mouserec1 = /(m)sc183Q000\.dat/ wide ascii
        //$mouserec2 = /2201[0-9A-F]{8}\.dat/ wide ascii

        $driver = /\\\\\\\\\.\\\\driverw/ wide ascii

        $janedow1 = /(J)ane Dow\'s x32 machine/ wide ascii
        $janedow2 = /(J)ane Dow\'s x64 machine/ wide ascii

        //$versions1 = /(f)inspyv2/ nocase
        //$versions2 = /(f)inspyv4/ nocase

        $bootkit1 = /(b)ootkit_x32driver/
        $bootkit2 = /(b)ootkit_x64driver/

        $typo1 = /(S)creenShort Recording/ wide

        $mssounddx = /(S)ystem\\CurrentControlSet\\Services\\mssounddx/ wide

    condition:
        (8 of ($password*) or any of ($screenrec*) or $micrec or any of ($skyperec*) or $driver or any of ($janedow*) or any of ($bootkit*) or $typo1 or $mssounddx) and not any of ($filter*)
}
Download all Yara Rules