logoalt Hacker News

rep_lodsbtoday at 12:57 AM3 repliesview on HN

This looks like slop, it's all concatenated into a single file and most probably not based on the actual malware. I'm fairly sure that for example the real one does not include the literal string "Stuxnet" anywhere, like it does here:

    RegDeleteKeyW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Stuxnet");
Wikipedia about the origin of the name:

    The original name given by VirusBlokAda was "Rootkit.Tmphider;"[41]
    Symantec, however, called it "W32.Temphid", later changing it to "W32.Stuxnet".[42]
    Its current name is derived from a combination of keywords found in the software (".stub" and "mrxnet.sys").[43][44]

Replies

ptidhommetoday at 5:59 AM

Interestinly, it does include the string "myrtus", which was likely it's real internal name.

https://medium.com/@arpit.writes/stuxnet-and-the-birth-of-di...

qarltoday at 1:25 AM

Yeah... it's reverse engineered. They explained that.

show 2 replies
nullbiotoday at 1:04 AM

Astra can reverse engineer binaries now. That's likely where it came from.

show 2 replies