TF-MAL-apk.finfisher
📛 Threat Title
Malware family: FinFisher
Description
ThreatFox malware family `apk.finfisher`. Printable name: FinFisher.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
apk.finfisher
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.finfisher
IOC database
- Type
- domain
- Value
apk.finfisher- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-apk.finfisher
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.finfisher
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:access.redhat.com
FinSpy, also known as FinFisher or WingBird, is a commercial-grade surveillance malware developed and sold by the German company FinFisher GmbH to law enforcement and intelligence agencies as a "lawful interception" tool. It functions as a sophisticated Remote Access Trojan (RAT), offering full remote control and data exfiltration capabilities, including communication interception. FinSpy ...
-
web:attack.mitre.org
FinFisher is a government-grade commercial surveillance spyware reportedly sold exclusively to government agencies for use in targeted and lawful criminal investigations.
-
web:bazaar.abuse.ch
A malware sample can be associated with only one malware family . The page below gives you an overview on malware samples that MalwareBazaar has identified as FinFisher .
-
web:cybersecuritynews.com
Two sophisticated Linux rootkits are posing increasingly serious threats to network security by exploiting eBPF technology to hide their presence from traditional detection systems. BPFDoor and Symbiote, both originating from 2021, represent a dangerous class of malware that combines advanced kernel-level access with powerful evasion capabilities.
-
web:en.wikipedia.org
FinFisher malware is installed in various ways, including fake software updates, emails with fake attachments, and security flaws in popular software. Sometimes the surveillance suite is installed after the target accepts installation of a fake update to commonly used software. [2] Code which will install the malware has also been detected in emails. [20] The software, which is designed to ...
-
web:malpedia.caad.fkie.fraunhofer.de
FinFisher is a commercial software used to steal information and spy on affected victims. It began with few functionalities which included password harvesting and information leakage, but now it is mostly known for its full Remote Access Trojan (RAT) capabilities.
-
web:www.fortinet.com
FortiGuard Labs discovered new Symbiote and BPFDoor variants exploiting eBPF filters to enhance stealth through IPv6 support, UDP traffic, and dynamic port hopping for covert C2 communication.
-
web:www.kaspersky.com
Kaspersky researchers presented a comprehensive investigation into all the recent updates introduced into FinSpy spyware for Windows, Mac OS, Linux, and its installers. The research, which took eight months to complete, uncovers four-layer obfuscation and advanced anti-analysis measures employed by the spyware's developers, as well as the employment of a UEFI bootkit to infect victims. The ...
-
web:www.microsoft.com
FinFisher is not afraid of using all kinds of tricks, ranging from junk instructions and "spaghetti code" to multiple layers of virtual machines and several known and lesser-known anti-debug and defensive measures. Security analysts are typically equipped with the tools to defeat a good number of similar tricks during malware investigations.
-
web:www.pcrisk.com
The malware again made headlines in September of last year when the malware was observed exploiting a .NET Framework zero-day (CVE-2017-8759) for infection. This prompted ESET to ask whether Internet service providers (ISPs) might be knowingly and directly involved in FinFisher's distribution process.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.