Description

FLAME PC VERSION is a hardware and software complex combining a PCI Express card and 2 USB boxes with modular software designed to recover data from damaged hard disks and/or copy by using hardware direct control over the disk. F.L.A.M.E. makes it possible to manage data recovery phases from the diagnosis to drive restoration and copy to a healthy drive or file image.

Flame PC VERSION is a sophisticated toolkit that has been used to collect information since at least 2010, largely targeting Middle East countries.

ID: S0143

ⓘ

Associated Software: Flamer, sKyWIper

ⓘ

Type: MALWARE

ⓘ

Platforms: Windows

Version: 1.1

Created: 31 May 2017

Last Modified: 16 April 2025

Version Permalink

FLAME PC VERSION Associated Software Descriptions

Name	Description
Flamer	^[1] ^[2]
sKyWIper	^[1] ^[3]

FLAME PC VERSION Techniques Used

Domain	ID		Name	Use
Enterprise	T1123		Audio Capture	Flame can record audio using any existing hardware recording devices.
Enterprise	T1547	.002	Boot or Logon Autostart Execution: Authentication Package	Flame can use Windows Authentication Packages for persistence.
Enterprise	T1136	.001	Create Account: Local Account	Flame can create backdoor accounts with login “HelpAssistant” on domain connected systems if appropriate rights are available.
Enterprise	T1011	.001	Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth	Flame has a module named BeetleJuice that contains Bluetooth functionality that may be used in different ways, including transmitting encoded information from the infected system over the Bluetooth protocol, acting as a Bluetooth beacon, and identifying other Bluetooth devices in the vicinity.
Enterprise	T1210		Exploitation of Remote Services	Flame can use MS10-061 to exploit a print spooler vulnerability in a remote system with a shared printer in order to move laterally.
Enterprise	T1036	.010	Masquerading: Masquerade Account Name	Flame can create backdoor accounts with login `HelpAssistant` on domain connected systems if appropriate rights are available.
Enterprise	T1091		Replication Through Removable Media	Flame contains modules to infect USB sticks and spread laterally to other Windows systems the stick is plugged into using Autorun functionality.
Enterprise	T1113		Screen Capture	Flame can take regular screenshots when certain applications are open that are sent to the command and control server.
Enterprise	T1518	.001	Software Discovery: Security Software Discovery	Flame identifies security software such as antivirus through the Security module.
Enterprise	T1218	.011	System Binary Proxy Execution: Rundll32	Rundll32.exe is used as a way of executing Flame at the command-line.
ICS	T0893		Data from Local System	Flame has built-in modules to gather information from compromised computers.
ICS	T0882		Theft of Operational Information	Flame can collect AutoCAD design data and visio diagrams as well as other documents that may contain operational information.

Click to enlarge

FLAME PC VERSION : SUMURI

Name: FLAME PC VERSION : SUMURI - TALINO TECH | Digital Forensics Solutions and Training
Price: 5000.00 USD
Availability: InStock

$5,000.00

The price of a three-year FLAME PC VERSION subscription is $15,000 .

Add to compare

Add to wishlist

0 People watching this product now!

Category: EDR TOOLS

Description
Reviews (0)

Name	Description
Flamer	^[1] ^[2]
sKyWIper	^[1] ^[3]

Domain	ID		Name	Use
Enterprise	T1123		Audio Capture	Flame can record audio using any existing hardware recording devices.
Enterprise	T1547	.002	Boot or Logon Autostart Execution: Authentication Package	Flame can use Windows Authentication Packages for persistence.
Enterprise	T1136	.001	Create Account: Local Account	Flame can create backdoor accounts with login “HelpAssistant” on domain connected systems if appropriate rights are available.
Enterprise	T1011	.001	Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth	Flame has a module named BeetleJuice that contains Bluetooth functionality that may be used in different ways, including transmitting encoded information from the infected system over the Bluetooth protocol, acting as a Bluetooth beacon, and identifying other Bluetooth devices in the vicinity.
Enterprise	T1210		Exploitation of Remote Services	Flame can use MS10-061 to exploit a print spooler vulnerability in a remote system with a shared printer in order to move laterally.
Enterprise	T1036	.010	Masquerading: Masquerade Account Name	Flame can create backdoor accounts with login `HelpAssistant` on domain connected systems if appropriate rights are available.
Enterprise	T1091		Replication Through Removable Media	Flame contains modules to infect USB sticks and spread laterally to other Windows systems the stick is plugged into using Autorun functionality.
Enterprise	T1113		Screen Capture	Flame can take regular screenshots when certain applications are open that are sent to the command and control server.
Enterprise	T1518	.001	Software Discovery: Security Software Discovery	Flame identifies security software such as antivirus through the Security module.
Enterprise	T1218	.011	System Binary Proxy Execution: Rundll32	Rundll32.exe is used as a way of executing Flame at the command-line.
ICS	T0893		Data from Local System	Flame has built-in modules to gather information from compromised computers.
ICS	T0882		Theft of Operational Information	Flame can collect AutoCAD design data and visio diagrams as well as other documents that may contain operational information.