sKyWIper (a.k.a. Flame a.k.a. Flamer): A complex ... - CrySyS Lab

6.1. Some interesting Lua scripts inside the code
CRUISE_CRED.lua
The script gathers credential information from an already infected machine. More precisely,
it cruises all the token objects to find the ones belong to the administrator or the
Administrators, Domain Admins groups. If it is successful, it updates cruiseAttackLog in the
“CLAN” database by means of the user sd and the user name. For more information, please
see the Tables creds and cruise_attack_log in Figure 48.
basic_info_app.lua
The script gathers basic information about an infected computer such as the flame version it
has been infected with, the computer name, the ip address of the machine. Furthermore, it
books various parameters about the nature of information leak (e.g.,
AVERAGE_LEAK_BANDWIDTH, LAST_LEAK_TO_INTERNET, MEDIA_LEAKS_FROM_THIS_
COMPUTER, etc). Note that the FLAME_VERSION parameter must have been used to avoid
the reinfection of the same computer and also to update flame if it is neccessary.
clan_seclog.lua
The script parses the Security log by searching for certain event Ids and retrieves the
correspondig username and ip information from it. It is supposedly used to collect
information about the traces of infection, or the credentials and source IPs used to
authenticate to the infected machine. The script examines the following event Ids, where
the corresponding log entries store the required pieces of information (Account Name, User
Name and IP address)
Event Id: 540 – Refers to successful network logon. Among various parameters the log stores
the User Name and Source Network Address as well.
Event Id: 672 – Refers to Authentication Ticket Granted Audit event. In case of Windows, the
Kerberos authentication uses the optional pre-authentication phase before issuing an
authentication ticket by checking the credentials of the client. If the client successfully
authenticated to the workstation, Windows puts a log entry with event id 672 into the
Security log in order to demonstrate the successful initial logon event.
Laboratory of Cryptography and System Security (CrySyS)
Budapest University of Technology and Economics
www.crysys.hu 48