3

I'm trying to figure out if any of our clients have been infected by the recent trojan/worm Flame.

I have access to our proxy logs, so I want to search for any requests made to the "known" C&C domains.

In this article, it says it uses 10 domains for C&C domain servers. Also in another report they found 50 C&C domains, IPs and mentioned domain-fluxing techniques.

Unfortunately, these domain servers are not publicly known (as-of-yet).

Have anyone found any publicly available sources mentioning the actual C&C domains?

Improve this question
2
  • 3
    Since Flame is a targeted attack, a question to ask early on is "would any of my clients be likely to be targeted?"
    – Graham Hill
    Commented May 31, 2012 at 16:17
  • • Am I protected from Flame? That's the wrong question. You should be asking yourself this: am I at risk? • Alright then, am I at risk from Flame? Let's see, are you a systems administrator for a Middle Eastern government? No? Then no… you aren't at risk. - f-secure.com/weblog/archives/00002372.html
    – Dog eat cat world
    Commented Jun 1, 2012 at 10:08

2 Answers 2

Reset to default
6

As far as I'm aware, Kaspersky were the first company to discover it and they've written some great blogs on it, with excellent detail on the registry keys, files etc that are affected but there isn't much information on the IP addresses of CC servers. Here's their most recent blog detailed the registry keys etc -

http://www.securelist.com/en/blog/208193538/Flame_Bunny_Frog_Munch_and_BeetleJuice

and in a previous blog, they talked about the communications to the C&C servers -

http://www.securelist.com/en/blog/208193522/The_Flame_Questions_and_Answers

saying that

"Recorded data is sent to the C&C through a covert SSL channel, on a regular schedule. We are still analyzing this; more information will be available on our website soon.

......"

so I think it's probably best to keep watching Kaspersky's blog as they appear to be further along in analysing Flame (although that can obviously change).

According to this post (http://blog.cuckoobox.org/2012/05/29/cuckoo-in-flame/), the domains/ips are being actively sinkholed, which possibly explains why there's nothing been publicised as of yet.

Update: Looks like Kaspersky have identified information on the C&C servers - http://www.securelist.com/en/blog/208193540/The_Roof_Is_on_Fire_Tackling_Flames_C_C_Servers.

Improve this answer
3

The only article I've seen so far that gives any IP or domain information is malwaresurival.net. It gives the following IP as one of the C&C servers: 91.203.214.72. Here is the actual article: http://malwaresurvival.net/2012/05/29/is-the-flame-malware-a-trojan-or-worm/

Edit: This website now has a lot more of the C&C domains on it. https://www.securelist.com/en/blog/208193540/The_Roof_Is_on_Fire_Tackling_Flames_C_C_Servers (After I updated this I just now saw that someone else has already linked to it. I'll go ahead and keep it on here for reference as well.)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .