Analysis of Flame C&C servers reveals more unknown malware

Since its discovery by Kaspersky Lab and CrySyS researchers back in May, the Flame malware and its C&C infrastructure are being analyzed for additional clues on who might be behind it.

Kaspersky Lab and Symantec, in conjunction with ITU-IMPACT and CERT-Bund/BSI, have revealed today worrisome new discoveries about other malware that seems to have been created and used alongside Flame.

After having analyzed two of the C&C servers and the information found on them, they came to a number of conclusions.

“The analyzed servers contain the same control framework, but they were used for distinct purposes. The server that was set up in March of 2012 shows evidence of having collected almost 6 GB of data from compromised computers in just over a week. In comparison, the server that was set up in May 2012 received just 75 MB of data and was used solely to distribute one command module to the compromised computers,” say Symantec researchers.

The servers could be accessed through a Web application called Newsforyou, which processes the W32.Flamer client interactions and provides a simple control panel – so simple, in fact, that it could be mistaken for a content management system for a blog or a news outlet:

“The C&C developers didn’t use professional terms such as bot, botnet, infection, malware-command or anything related in their control panel. Instead they used common words like data, upload, download, client, news, blog, ads, backup etc,” shared Kaspersky Lab experts. “We believe this was deliberately done to deceive hosting company sys-admins who might run unexpected checks.”

But the most important discovery is the fact that the application for the control panel hasn’t been exclusively used for Flame. “It contains functionality that allows it to communicate with computers compromised with multiple malware identifiers using different protocols,” the researchers say.

There are four active protocols, and only one is used by Flame. The malware using the remaining four is unknown – could be Flame variants, or totally different malware altogether. But according to Kaspersky researchers, one of these Flame-related unknown malicious objects is currently operating in the wild.

“The servers were set up to record minimal amounts of information in case of discovery. The systems were configured to disable any unnecessary logging events and entries in the database were deleted at regular intervals. Existing log files were securely deleted from the server on a regular basis. These steps were taken in order to hamper any investigation should the server be acquired by third parties,” points out Symantec.

“The attackers were not thorough enough, however, as a file revealing the entire history of the server”s setup was available. In addition, a limited set of encrypted records in the database revealed that compromised computers had been connecting from the Middle East. We were also able to recover the nicknames of four authors—D***, H*****, O******, and R***—who had worked on the code at various stages and on differing aspects of the project, which appear to have been written as far back as 2006.”

The thing that seems to confirm the theory that the people behind this were not well-funded criminals, but were part of a military and/or intelligence operation, is that the server operators could not know which modules were pushed out to which machines because the control panel does not function as transparently as most other ones, and the collected information that was stolen from compromised computers was stored on the servers but in encrypted format, and no key to decrypt it was found on it.