Loading malware…
Flame, also known as Flamer and sKyWIper/Skywiper, is a highly sophisticated, modular Windows cyber-espionage malware platform publicly disclosed in 2012 and assessed by multiple researchers as having operated for years before discovery. It is widely described as a large toolkit, roughly 20 MB when fully deployed, built to receive and install additional modules for different objectives.
High-confidence reporting in the provided content describes Flame as an intelligence-collection platform rather than primarily a destructive payload. Documented capabilities include keystroke logging, screenshot capture, microphone/audio recording, theft of documents and instant messaging data, network sniffing, network resource discovery, password collection, disk scanning for specific file types and contents, Bluetooth-related collection such as phone contact data, and exfiltration of stolen data to command-and-control infrastructure. The malware used multiple encryption and compression methods, SQLite databases for structured storage, and Lua scripting. It also included stealthy code injection into processes such as winlogon.exe, services.exe, and explorer.exe, and persistence via the Windows LSA Authentication Packages registry mechanism referencing mssecmgr.ocx.
The content states that Flame infected Windows XP, Vista, and 7 systems and spread through several mechanisms, including removable media/USB devices, local networks and shares, Windows Update-themed propagation, and use of Stuxnet-related exploits MS10-061 and MS10-046. One of its most notable techniques was the use of forged Microsoft code-signing certificates enabled by an MD5 chosen-prefix collision attack, allowing Flame to masquerade as legitimate Microsoft software and hijack Windows Update on local networks. The malware also supported exfiltration from air-gapped environments by storing stolen data on infected USB drives for later upload when connected to an Internet-reachable system. In June 2012, operators reportedly deployed a kill/self-removal module that deleted Flame artifacts and overwrote related storage locations with random data to hinder forensic analysis.
Researchers in the content associate Flame with targeted attacks and sensitive intelligence collection across the Middle East, with reported infections including Iran, Israel/Palestine, Sudan, Syria, Lebanon, Saudi Arabia, Egypt, and also references to infections in Hungary. Reported targeting focused on sensitive information and selected systems rather than broad commodity crime. Multiple sources in the content describe Flame as closely related to Stuxnet and Duqu, with some reporting code overlap and shared development links; several cited reports and officials further state or allege U.S.-Israeli involvement, though some technical analyses in the content note that evidence for exact development relationships was at times inconclusive.
Indicators and artifacts directly mentioned in the content include the LSA Authentication Packages registry reference to mssecmgr.ocx and component filenames such as mssecmgr.ocx, ccalc32.sys, msglu32.ocx, boot32drv.sys, nteps32.ocx, advnetcfg.ocx, soapr32.ocx, wavesup3.drv, wpgfilter.dat, and temporary files such as ~DEB93D.tmp and ~rf<number>.tmp. The content also notes use of more than 10 command-and-control domains and secure C2 communications over SSH and HTTPS.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Flame (a.k.a Flamer or sKyWIper) was the object of extensive research and fascination by the security community circa 2011.
Three years ago, on May 28th 2012, we announced the discovery of a malware known as Flame. At the same time we published our FAQ, CrySyS Lab posted their thorough analysis of sKyWIper. A few days earlier, Maher CERT published IOCs for Flamer. In short, Flame, sKyWIper and Flamer are different names for the same threat.
41 distinct techniques documented for this family, organized by ATT&CK tactic.
var s = GetObject("winmgmts:root\\cimv2");var oProcs = s.ExecQuery("SELECT * FROM Win32_Process ..."); s.Delete("__EventFilter.Name='FilterForClassCreation'");
var objFileSystem = new ActiveXObject("Scripting.FileSystemObject");var s = GetObject("winmgmts:root\\cimv2");
Frog Infect machines using pre-defined user accounts. The only user account specified in the configuration resource is “HelpAssistant” that is created by the “Limbo” attack.
Limbo Creates backdoor accounts with login “HelpAssistant” on the machines within the network domain if appropriate rights are available.
The malware can be started using two different methods: 1. Set msgsecmgr.ocx in the registry ... At startup, mssecmgr.ocx is loaded as LSA Authentication Package.
There are multiple injections of code during startup... the code injection mechanism is stealthier such that the presence of the code injection cannot be determined by conventional methods... these regions must have been allocated dynamically by means of VirtualAllocEx() or WriteProcessMemory().
The 2009 Stuxnet was built to replicate using an exploit from Flame. This indicates the two were indeed connected.
Frog Infect machines using pre-defined user accounts. The only user account specified in the configuration resource is “HelpAssistant” that is created by the “Limbo” attack.
The malware can be started using two different methods: 1. Set msgsecmgr.ocx in the registry ... At startup, mssecmgr.ocx is loaded as LSA Authentication Package.
There are multiple injections of code during startup... the code injection mechanism is stealthier such that the presence of the code injection cannot be determined by conventional methods... these regions must have been allocated dynamically by means of VirtualAllocEx() or WriteProcessMemory().
Self-kill logic inside ... SUICIDE.RESIDUAL_FILES ... %temp%\~a28.tmp ... %windir%\system32\commgr32.dll
Frog Infect machines using pre-defined user accounts. The only user account specified in the configuration resource is “HelpAssistant” that is created by the “Limbo” attack.
Snack Listens on network interfaces, receives and saves NBNS packets in a log file.
It covers all major possibilities to gather intelligence, including keyboard, screen, microphone, storage devices, network, wifi, Bluetooth, USB and system processes.
The massive piece of malware secretly mapped and monitored Iran's computer networks, sending back a steady stream of intelligence to prepare for a cyberwarfare campaign.
Beetlejuice Bluetooth: enumerates devices around the infected machine. May turn itself into a “beacon”
Snack Listens on network interfaces, receives and saves NBNS packets in a log file.
Beetlejuice Bluetooth: enumerates devices around the infected machine... Snack Listens on network interfaces, receives and saves NBNS packets in a log file.
Compressed parts contain info on running processes... ~HLV473.tmp – information on running processes inside (Far.exe)
lmcache.dat Information on target computer. ntcache.dat Information on target computer... basic_info_app.lua gathers basic information about an infected computer such as the flame version ... the computer name, the ip address of the machine.
Weasel Creates a directory listing of the infected computer... The malware saves ~rf<number> files in /windows/temp... storing information on drivers, directories, and file names.
Transport: Replication method... that based on bad access permissions is a “Transport”. E.g. “NU” or “NUSystem” refers to “net use” way of propagation. obj.REMOTE_PATH_TEMPLATES = {temp = string.format("\\\\%s\\admin$\\temp", l_4_0.tgt)
Infectmedia Selects one of the methods for infecting media, i.e. USB disks. Available methods: Autorun_infector, Euphoria.
The malware was designed to automatically collect everything from infected machines, ranging from documents to screenshots, keystrokes and audio.
It covers all major possibilities to gather intelligence, including keyboard, screen, microphone, storage devices, network, wifi, Bluetooth, USB and system processes.
Munch: Installation/propagation mechanism related to windows update and web downloads... HTTP server that responds to “/view.php” and “/wpad.dat” requests.
The routine downloads the file mssecmgr.ocx ... Further information shows that this is related to the windows update mechanism and the MUNCH attack
29 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
55 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a highly sophisticated espionage malware example from the era of detailed public technical teardowns.
Referenced as a sophisticated malware framework known for embedding a Lua scripting engine to provide modularity.
A sophisticated malware platform discovered in 2012 that incorporated a Lua virtual machine.
A known nation-state espionage malware/toolkit referenced for comparison with fast16.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.