Microsoft FinFisher March 2018

FinFisher queries Registry values as part of its anti-sandbox checks.

FinFisher is heavily obfuscated in many ways, including through the use of spaghetti code in its functions in an effort to confuse disassembly programs. It also uses a custom XOR algorithm to obfuscate code.

FinFisher contains junk code in its functions in an effort to confuse disassembly programs.

FinFisher renames one of its .dll files to uxtheme.dll in an apparent attempt to masquerade as a legitimate file.

FinFisher injects itself into various processes depending on whether it is low integrity or high integrity.

FinFisher checks its parent process for indications that it is running in a sandbox setup.

FinFisher checks if the victim OS is 32 or 64-bit.

FinFisher enumerates directories and scans for certain files.

FinFisher takes a screenshot of the screen and displays it on top of all other windows for few seconds in an apparent attempt to hide some messages showed by the system during the setup process.

FinFisher uses token manipulation with NtFilterToken as part of UAC bypass.

FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources.

FinFisher obtains the hardware device list and checks if the MD5 of the vendor ID is equal to a predefined list in order to check for sandbox/virtualized environments.

Some FinFisher variants incorporate an MBR rootkit.

FinFisher creates a new Windows service with the malicious executable for persistence.

FinFisher establishes persistence by creating the Registry key HKCU\Software\Microsoft\Windows\Run.

FinFisher performs UAC bypass.

FinFisher uses DLL side-loading to load malicious programs. A FinFisher variant also uses DLL search order hijacking.

FinFisher clears the system event logs using OpenEventLog/ClearEventLog APIs .