MITRE ATT&CKsoftware (malware)

S0182 FinFisher

Published 2018-01-16 Modified 2024-09-12 Official page ↗
Domain
enterprise, mobile
Platforms
Windows, Android
Aliases
FinSpy
Version
1.4
Created
2018-01-16

Description

FinFisher is a government-grade commercial surveillance spyware reportedly sold exclusively to government agencies for use in targeted and lawful criminal investigations. It is heavily obfuscated and uses multiple anti-analysis techniques. It has other variants including Wingbird.

Related

Uses · MITRE ATT&CK (27)

  • T1685.005 Clear Windows Event Logs sub-technique
  • T1027.016 Junk Code Insertion sub-technique
  • T1636.002 Call Log sub-technique
  • T1636.004 SMS Messages sub-technique
  • T1574.013 KernelCallbackTable sub-technique
  • T1574.001 DLL sub-technique
  • T1497.001 System Checks sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1134.001 Token Impersonation/Theft sub-technique
  • T1056.004 Credential API Hooking sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1027.002 Software Packing sub-technique
  • T1548.002 Bypass User Account Control sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1543.003 Windows Service sub-technique
  • T1055.001 Dynamic-link Library Injection sub-technique
  • T1542.003 Bootkit sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1404 Exploitation for Privilege Escalation technique
  • T1429 Audio Capture technique
  • T1430 Location Tracking technique
  • T1012 Query Registry technique
  • T1027 Obfuscated Files or Information technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1113 Screen Capture technique

Referenced by MITRE ATT&CK · uses (1)

  • G0070 Dark Caracal group

References