sKyWIper (a.k.a. Flame a.k.a. Flamer): A complex ... - CrySyS Lab

The malware contains the following modules:
Related OCX files:
mssecmgr.ocx (6 M) Main module
-- resource 146 (2.5 M) Compressed file with some zlib-like compression
advnetcfg.ocx (0.6 M) Injected part, possibly info stealer (screen shots and alike)
msglu32.ocx (1.6 M) Created by main module
nteps32.ocx (0.8 M) Created by main module
soapr32.ocx (0.2 M) Can be found in resource 146, possibly network based propagation
module
The main module of the malware is mssegmgr.ocx, which is 6 MByte long. It is loaded at
startup, and later copied to wavesup3.drv. The main module also creates other OCX modules
as shown in the above list.
Related files in the Windows/Temp folder:
To691.tmp (1.5 M) Initial settings data file
Related files in the Windows/System32 folder:
ccalc32.sys Configuration settings table, fully encrypted. It is generated by the
malware installer process, and stored in uncompressed Resource
146 of mssecmgr.sys at position 0x00001E7118. It is encrypted by
RC4 (128).
boot32drv.sys (~1 K) Desktop window related data, encrypted by XOR with 0xFF
Temporary files created by the malware:
~DEB93D.tmp Encrypted file containing SQLite database of nmb lookups. Written
by services.exe.
~HLV084.tmp Compressed parts contain info on running processes. Written by
winlogon.exe.
~HLV294.tmp Purpose unknown. This and 4-5 similar files often appear on
infected systems.
~KWI Compressed parts contain info on running processes. Written by
winlogon.exe.
Laboratory of Cryptography and System Security (CrySyS)
Budapest University of Technology and Economics
www.crysys.hu 10