FinFisher

FinFisher queries Registry values as part of its anti-sandbox checks.

FinFisher is heavily obfuscated in many ways, including through the use of spaghetti code in its functions in an effort to confuse disassembly programs. It also uses a custom XOR algorithm to obfuscate code.

A FinFisher variant uses a custom packer.

FinFisher contains junk code in its functions in an effort to confuse disassembly programs.

FinFisher renames one of its .dll files to uxtheme.dll in an apparent attempt to masquerade as a legitimate file.

FinFisher injects itself into various processes depending on whether it is low integrity or high integrity.

FinFisher hooks processes by modifying IAT pointers to CreateWindowEx.

FinFisher checks its parent process for indications that it is running in a sandbox setup.

FinFisher checks if the victim OS is 32 or 64-bit.

FinFisher enumerates directories and scans for certain files.

FinFisher takes a screenshot of the screen and displays it on top of all other windows for few seconds in an apparent attempt to hide some messages showed by the system during the setup process.

FinFisher uses token manipulation with NtFilterToken as part of UAC bypass.

FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources.

FinFisher obtains the hardware device list and checks if the MD5 of the vendor ID is equal to a predefined list in order to check for sandbox/virtualized environments.

FinFisher probes the system to check for antimalware processes.