Classification

Category :

Malware

Type :

Trojan

Aliases :

Flame, Trojan.Flame.A, Trojan.Flame.B, Trojan.Generic.KD.633944, Flamer, Skywiper

Summary

Flame is a sophisticated information-gathering program used in targeted cyber-attacks against organizations and nation states in the Middle East.

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Submit a Sample to the Labs

If you have a file detected as Flame, we would greatly appreciate it if you submit a sample of the suspect file to our Security Lab for further analysis via:

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

Flame is a massive, complex and sophisticated malware designed for information gathering and espionage. Initial reports have termed this malware an 'attack toolkit' or 'platform', as it includes capabilities similar to a trojan, a worm, and a botnet-controlled backdoor.

Though the identity of the attackers remains unknown, the objective of this malware appears to be information gathering focused on organizations, institutions or nation states in the Middle East. There is speculation that this form of espionage is most likely perpetrated by a rival nation state, though no strong confirmation currently exists.

Flame's technical complexity and its usage suggests a link with prior targeted malwares Stuxnet and Duqu, though there is no reported similarity in the source code of the various malwares.

This malware is further discussed in the following Labs Weblog post:

Technical Details

Due to its massive size - approximately 20MB - and the complexity of its structure, analysis of the malware has been challenging and is still ongoing. The following details are based on information released in initial reports.

The malware itself is composed of multiple modules, each with specific roles. These components may be modified or removed, and new modules added, by the attackers. Among its reported capabilities are:

  • Replicates via removable media, and through local networks using known vulnerabilities
  • Capable of infecting Windows XP, Vista and 7 operating systems
  • Able capture environment sounds via the system's microphone
  • Able to capture screenshots when specific processes or windows are active
  • Able to forward saved information to a remote server
  • Multple command and control (C&C) servers and domains used

Initial reports indicate that multiple versions of Flame have been circulating in the wild for some time, without being detected by any major antivirus programs or other security software. At the time of writing, F-Secure has detections for known sample components.

More Information

More information, including technical analysis, is available from: