sKyWIper (a.k.a. Flame a.k.a. Flamer): A complex ... - CrySyS Lab

Many DAT files have the following structure: A table is stored in a file, containing key-value
pairs. The key-value pairs are separated by multiple 0xFF characters (like padding), in some
files with multiple 0xAE characters (Duqu often used 0xAE as well). Between the key and
value 0xFF, 0xFE separates the data.
The ~DEB93D files contain Samba / nmb lookups in a proprietary table format
0000000000: 26 C1 30 0E 51 36 XX 4F │ 03 00 00 22 00 00 00 31 &Á0♫Q6XO♥ " 1
0000000010: 00 39 00 32 00 2E 00 31 │ 00 36 00 38 00 2E 00 30 9 2 . 1 6 8 . 0
0000000020: 00 2E 00 31 00 31 00 20 │ 00 57 00 50 00 41 00 44 . 1 1 W P A D
0000000030: 00 52 36 XX 4F 03 00 00 │ 22 00 00 00 31 00 39 00 R6XO♥ " 1 9
0000000040: 32 00 2E 00 31 00 36 00 │ 38 00 2E 00 30 00 2E 00 2 . 1 6 8 . 0 .
0000000050: 31 00 31 00 20 00 57 00 │ 50 00 41 00 44 00 52 36 1 1 W P A D R6
0000000060: XX 4F 03 00 00 2E 00 00 │ 00 31 00 39 00 32 00 2E XO♥ . 1 9 2 .
0000000070: 00 31 00 36 00 38 00 2E │ 00 30 00 2E 00 31 00 31 1 6 8 . 0 . 1 1
0000000080: 00 20 00 47 00 4F 00 4F │ 00 47 00 4C 00 45 00 2E G O O G L E .
0000000090: 00 43 00 4F 00 4D 00 53 │ 36 XX 4F 03 00 00 22 00 C O M S6XO♥ "
Figure 34 – “8F AF AC 84” PPMd compressed record in ntcache.dat
The table format is as follows: Ater 4 bytes header every record begins with UNIX timestamp
(like 0x4FXX3651 in the figure), then “03 00 00” is some kind of record header, “22” refers to
record length, but you should add 3, as the next “00 00 00” is not strictly related to the
record, so the real payload without the “00 00 00” string is 0x22 bytes long.
Most of the records are readable queries like the ones above, but some contain raw samba
protocol data.
The creation of ~DEB93D files are connected to nteps32 export functions, possibly
EnableSHR, but this is not confirmed yet.
4.4. Data storage formats
Although the HLV and KWI file formats are not yet fully understood, these files contain data
resembling to database table records and some records of the above described compressed
formats.
From the extracted contents of some of these data files we found that they all (HLV, KWI,
and even ntcache.dat) contain basic information on running processes. The information is
about 1000-2000 bytes of redundant data. It contains the actual status of the running
program, and in some cases, historical data as well. In some cases, they seem to contain
screenshot related information besides the list of running processes.
Laboratory of Cryptography and System Security (CrySyS)
Budapest University of Technology and Economics
www.crysys.hu 36