sKyWIper (a.k.a. Flame a.k.a. Flamer): A complex ... - CrySyS Lab

6. Attack details – dictionary and scripts
The file dstrlog.dat contains a ClanDB for names and terms used by the malware, an SQLite
database used for attacks. This file is loaded through libclandb.lua by SQL commands, and
the database is accessed using Lua scripts. We disclose detailed description of the SQLite
database to show the SQL tables used for attacks. The attackers even take care of versions,
and update the structure if necessary. The sample below shows a version upgrade script.
if userVer == 1 or userVer == 2 then l_26_0:exec("\n
ALTER TABLE entities ADD COLUMN tool_id INTEGER NULL;\n
ALTER TABLE entities ADD COLUMN first_update_dt DATETIME INTEGER NULL;\n
ALTER TABLE entities ADD COLUMN last_update_dt DATETIME INTEGER NULL;\n
ALTER TABLE entities ADD COLUMN last_ip_update_dt DATETIME INTEGER NULL;\n
ALTER TABLE metadata ADD COLUMN first_update_dt DATETIME INTEGER NULL;\n
ALTER TABLE metadata ADD COLUMN last_update_dt DATETIME INTEGER NULL;\n
ALTER TABLE attack_log ADD COLUMN home_id INTEGER NULL;\n
ALTER TABLE attack_log ADD COLUMN date_dt DATETIME INTEGER NULL;\n
ALTER TABLE attack_queue ADD COLUMN min_attack_interval INTEGER NULL;\n
ALTER TABLE attack_queue ADD COLUMN home_id INTEGER NULL;\n ALTER TABLE
attack_queue ADD COLUMN last_try_date_dt DATETIME INTEGER NULL;\n
ALTER TABLE attack_queue ADD COLUMN igno
re_max BOOLEAN INTEGER NOT NULL DEFAULT 0;\n\n\t\t\tCREATE TABLE IF NOT EXISTS
cruise_attack_log (\n\t\t\t log_id INTEGER NOT NULL REFERENCES
attack_log(line_id),\n\t\t\t user_sid TEXT NOT NULL,\n\t\t\t usersKyWIper TEXT
NULL\n\t\t\t);\n\n
\t\t\tCREATE TABLE IF NOT EXISTS options_per_entity (\n\t\t\t entity_id INTEGER
NOT NULL,\n\t\t\t attack_type TEXT NOT NULL,\n\t\t\t cred_id INTEGER
NULL,\n\t\t\t retries_left INTEGER NULL\n\t\t\t);\n\n CREATE TABLE IF
NOT EXISTS attack_params (\n attack_queue_id INTEGER NOT NULL,\n
name TEXT NOT NULL,\n
value NUMERIC NULL,\n\n
PRIMARY KEY(attack_queue_id, name)\n );")
Figure 42 – ClanDB update if version is too old
There are a number of names and phrases in the database used in the code of the malware.
Deeper analysis is needed to fully understand all these references. Here, we include the
result of our initial investigation with a note that these interpretations might not be correct.
Boost: Possibly information gathering based on enquiries received from remote parties.
Flame: Common name for attacks, most likely by exploits. Ef_trace.txt relation.
%temp%\dat3C.tmp and %systemroot%\\temp\\msdclr64.ocx related.
Laboratory of Cryptography and System Security (CrySyS)
Budapest University of Technology and Economics
www.crysys.hu 44