Full analysis of Flame's Command & Control servers
(Publication) Google search: [1]
| Full analysis of Flame's Command & Control servers | |
|---|---|
| Botnet | Flame |
| Malware | |
| Botnet/malware group | |
| Exploit kits | |
| Services | |
| Feature | |
| Distribution vector | |
| Target | |
| Origin | |
| Campaign | |
| Operation/Working group | |
| Vulnerability | |
| CCProtocol | |
| Date | 2012 / September 17, 2012 |
| Editor/Conference | Kaspersky lab |
| Link | http://www.securelist.com/en/blog/750/Full Analysis of Flame s Command Control servers (Archive copy) |
| Author | GReAT |
| Type | |
Abstract
“ Our previous analysis of the Flame malware, the advanced cyber-espionage tool that's linked to the Stuxnet operation, was initially published at the end of May 2012 and revealed a large scale campaign targeting several countries in the Middle East.
The Flame malware, including all of its components, was very large and our ongoing investigation revealed more and more details since that time. The news about this threat peaked on 4th June 2012, when Microsoft released an out-of-band patch to block three fraudulent digital certificates used by Flame. On the same day, we confirmed the existence of this in Flame and published our technical analysis of this sophisticated attack. This new side of Flame was so advanced that only the world's top cryptographers could be able to implement it. Since then, skeptical jokes about Flame have disappeared.
Later in June, we definitively confirmed that Flame developers communicated with the Stuxnet development team, which was another convincing fact that Flame was developed with nation-state backing.
We also published our analysis of the Flame command-and-Control (C&C) servers based on external observations and publicly available information. That helped our understanding of where the C&C servers were located and how they were registered.
With this blog post, we are releasing new information that was collected during forensic analysis of the Flame C&C servers. This investigation was done in partnership with Symantec, ITU-IMPACT and CERT-Bund/BSI.
Bibtex
@misc{Lua error: Cannot create process: proc_open(/dev/null): failed to open stream: Operation not permitted2012BFR1164,
editor = {Kaspersky lab},
author = {GReAT},
title = {Full analysis of Flame's Command & Control servers},
date = {17},
month = Sep,
year = {2012},
howpublished = {\url{http://www.securelist.com/en/blog/750/Full_Analysis_of_Flame_s_Command_Control_servers}},
}