5 ms·
This looks like slop, it's all concatenated into a single file and most probably not based on the actual malware. I'm fairly sure that for example the real one
by rep_lodsb 26d ago
This looks like slop, it's all concatenated into a single file and most probably not based on the actual malware. I'm fairly sure that for example the real one does not include the literal string "Stuxnet" anywhere, like it does here:
RegDeleteKeyW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Stuxnet");
Wikipedia about the origin of the name:
The original name given by VirusBlokAda was "Rootkit.Tmphider;"[41]
Symantec, however, called it "W32.Temphid", later changing it to "W32.Stuxnet".[42]
Its current name is derived from a combination of keywords found in the software (".stub" and "mrxnet.sys").[43][44]
- nullbio 26d agoAstra can reverse engineer binaries now. That's likely where it came from.
- rep_lodsb 26d agoBut then did it hallucinate that registry key? Or this? "instance of ActiveScriptEventConsumer as $Consumer\n" "{\n" " Name = \"StuxnetConsumer\";\n" " ScriptingEngine = \"VBScript\";\n" " ScriptText = \"CreateObject(\\\"WScript.Shell\\\").Run \\\"%SystemRoot%\\\\system32\\\\winsta.exe\\\", 0, False\";\n" "};\n"
- CMDDestory 26d ago[flagged]
- Retr0id 25d agoWhat?
- deleted 26d ago[deleted]
- qarl 26d agoYeah... it's reverse engineered. They explained that.
- rep_lodsb 26d agoAnd the Wikipedia article explains where the name came from, a combination of ".stub" and "mrxnet.sys". Not one literal string as it appears several times in this purported "reconstruction". Including as the name for a registry key, in the hex code at the end of an EXE header stub ("REALTEK",0x00,"Stuxnet"), and in a frigging autorun.inf as the program name. Even if Wikipedia is wrong and that string should appear somewhere in the original binary, whatever LLM they used has really been overdoing it beyond the bounds of realism: "Hey look, it's the REAL STUXNET, you've all read about it, here is the 100% real authentic reverse-engineered source code!"
- qarl 26d agoYeah... you've convinced me. An reverse engineering LLM should/would never invent literal strings in the code.
- whimsicalism 26d agoas the other commentator said, it's one thing if it's just variable names (opaque to reverse engineering) but the fact that it is registry keys....
- qarl 26d agoYou make a compelling argument.
- ptidhomme 25d agoInterestinly, it does include the string "myrtus", which was likely it's real internal name. https://medium.com/@arpit.writes/stuxnet-and-the-birth-of-digital-warfare-133f5db927bb https://medium.com/@arpit.writes/stuxnet-and-the-birth-of-di...