Flame is a sophisticated information-gathering program used in targeted cyber-attacks against organizations and nation states in the Middle East.
If you have a file detected as Flame, we would greatly appreciate it if you submit a sample of the suspect file to our Security Lab for further analysis via:
Find the latest advice in our Community Knowledge Base.
See the manual for your F-Secure product on the Help Center.
Submit a file or URL for further analysis.
Flame is a massive, complex and sophisticated malware designed for information gathering and espionage. Initial reports have termed this malware an 'attack toolkit' or 'platform', as it includes capabilities similar to a trojan, a worm, and a botnet-controlled backdoor.
Though the identity of the attackers remains unknown, the objective of this malware appears to be information gathering focused on organizations, institutions or nation states in the Middle East. There is speculation that this form of espionage is most likely perpetrated by a rival nation state, though no strong confirmation currently exists.
This malware is further discussed in the following Labs Weblog post:
Due to its massive size - approximately 20MB - and the complexity of its structure, analysis of the malware has been challenging and is still ongoing. The following details are based on information released in initial reports.
The malware itself is composed of multiple modules, each with specific roles. These components may be modified or removed, and new modules added, by the attackers. Among its reported capabilities are:
Initial reports indicate that multiple versions of Flame have been circulating in the wild for some time, without being detected by any major antivirus programs or other security software. At the time of writing, F-Secure has detections for known sample components.
More information, including technical analysis, is available from:
Description Created: 30 May 2012 03:00 GMT