11–20 of 62 posts
Somehow, I don't think the original authors of this proprietary code are going to be filing a copyright claim...
Secrecy aside, there may be some other issues with copywriting a product (allegedly) made by a government.
I very much recommend reading "Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon". Fascinating stuff.
RegDeleteKeyW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Stuxnet");
The original name given by VirusBlokAda was "Rootkit.Tmphider;"[41]
Symantec, however, called it "W32.Temphid", later changing it to "W32.Stuxnet".[42]
Its current name is derived from a combination of keywords found in the software (".stub" and "mrxnet.sys").[43][44]This looks like slop, it's all concatenated into a single file and most probably not based on the actual malware. I'm fairly sure that for example the real one does not include the literal string "Stuxnet" anywhere, like it does here: RegDeleteKeyW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Stuxnet"); Wikipedia about the origin of the name: The original name given by VirusBlokAda was "Ro…
Earlier quoted context omitted.
If you're using coding agents for this, it may be worth splitting this up into multiple well arranged modules that tell a coherent story and make it easy to browse, and add explanatory docs based on the various things the LLM has found about each function / type.
Waste of tokens IME, better to do it like this and leave that kind of post processing to signature obfuscation. You don't need exploratory docs, try asking one for complete function signatures of all the Windows APIs used, it's going to spit the docs out.
This looks like slop, it's all concatenated into a single file and most probably not based on the actual malware. I'm fairly sure that for example the real one does not include the literal string "Stuxnet" anywhere, like it does here: RegDeleteKeyW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Stuxnet"); Wikipedia about the origin of the name: The original name given by VirusBlokAda was "Ro…
Astra can reverse engineer binaries now. That's likely where it came from.
"instance of ActiveScriptEventConsumer as $Consumer\n"
"{\n"
" Name = \"StuxnetConsumer\";\n"
" ScriptingEngine = \"VBScript\";\n"
" ScriptText = \"CreateObject(\\\"WScript.Shell\\\").Run \\\"%SystemRoot%\\\\system32\\\\winsta.exe\\\", 0, False\";\n"
"};\n"g_dwCentrifugeDestroyed++;
Thanks for posting! ~15k lines of code, a lot to poke around in. I was working on a Siemens S7 PLC project with a WINCC HMI for a power plant (the same target of the cyber-weapon) as I listened to the audio book[2] based on this ~12 years ago, entirely changed how I viewed critical industrial infrastructure. One quote from the book that stuck with me was how you can only use a cyber weapon once at full potential, as…