I will be going over the FinFisher suite, recently leaked by WikiLeaks. FinFisher is malware used by foreign governments to for spying. I’ll be short and sweet in discussing how it packs, unpacks, decrypts, and drops a rootkit. I will then go over the rootkit, and then go over the detection using YARA.