sKyWIper (a.k.a. Flame a.k.a. Flamer): A complex ... - CrySyS Lab

Table of contents
1. Introduction .............................................................................................................................................5
1.1. Investigation............................................................................................................................................................ 5
1.2. History and build dates ...................................................................................................................................... 5
1.3. Build dates................................................................................................................................................................ 6
1.4. Comparison to Duqu (Stuxnet) at a glance............................................................................................... 7
2. Main components ...................................................................................................................................9
2.1. Modules...................................................................................................................................................................... 9
2.2. File listing and hashes.......................................................................................................................................11
3. Activation and propagation............................................................................................................. 13
3.1. Startup sequence.................................................................................................................................................13
3.2. Bootup experiments to gather timing information.............................................................................15
3.3. Injections.................................................................................................................................................................17
3.4. Hooks ........................................................................................................................................................................20
3.5. Mutexes....................................................................................................................................................................21
3.6. nteps32 exports....................................................................................................................................................21
3.7. Installation and propagation method.......................................................................................................22
4. Description of components.............................................................................................................. 24
4.1. Encryption algorithms......................................................................................................................................24
4.2. Registry parts........................................................................................................................................................32
4.3. Compression and table formats....................................................................................................................34
4.4. Data storage formats ........................................................................................................................................36
4.5. Logging file list.....................................................................................................................................................38
4.6. Saving additional information......................................................................................................................39
5. C&C communication ........................................................................................................................... 41
6. Attack details – dictionary and scripts ........................................................................................ 44
6.1. Some interesting Lua scripts inside the code.........................................................................................48
6.2. Related files............................................................................................................................................................51
6.3. SQLite table structure of CLAN DB..............................................................................................................52
7. Evasion techniques ............................................................................................................................. 56
7.1. Security programs relation ............................................................................................................................56
7.2. Design choices and tricks ................................................................................................................................56
7.3. Malware’s own files list ....................................................................................................................................57
Laboratory of Cryptography and System Security (CrySyS)
Budapest University of Technology and Economics
www.crysys.hu 4