I doubt its advanced, their customer list doesn't include well established players like China, Russia and the USA. In fact, this might be the cheapest militarized malware you can get. The only way to go cheaper is to use a TeamViewer RAT.

It might not be the most advanced out there, but I wouldn't belittle the surveillance ability of countries like Pakistan, Qatar, Bahrain, and South Africa.

Surprised to see Italy on there, though.

https://wikileaks.org/spyfiles4/customers.html

I didn't see any zips. Though zip is not the only vector one should be concerned with. For downloadable files, handle with extreme care. Exploration of the database content however is static and i'm sure the Internet will thank you if you parse and compile a list of interesting patterns you find from it.

It would be fun to install in a VM though! Or maybe not.

It will phone home. Don't do it unless it's disconnected from the network. It might also try to spread the infection through other attack vectors, like bluetooth, or trying to break out of the VM.

More likely it would self-destruct to avoid analysis or detection, this is well documented behavior of a number of more sophisticated pieces of malware.

> break out of the VM

I wonder if this has happened yet?

Most definitely. Here is an example: http://1337day.com/exploit/22519

Got anything that doesn't involve the 2d/3d video acceleration? Those are a rather obvious and off-by-default attack surface.

See here http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_...

Down for me. Here's a cached version:

https://web.archive.org/web/20140703130707/www.vupen.com/blo...

The equivalent of handling Ebola in your home kitchen.