This looks like slop, it's all concatenated into a single file and most probably not based on the actual malware. I'm fairly sure that for example the real one does not include the literal string "Stuxnet" anywhere, like it does here:

    RegDeleteKeyW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Stuxnet");

Wikipedia about the origin of the name:

    The original name given by VirusBlokAda was "Rootkit.Tmphider;"[41]
    Symantec, however, called it "W32.Temphid", later changing it to "W32.Stuxnet".[42]
    Its current name is derived from a combination of keywords found in the software (".stub" and "mrxnet.sys").[43][44]

▲ qarl 2 hours ago | parent | next [-]

Yeah... it's reverse engineered. They explained that.

▲

whimsicalism an hour ago | parent | next [-]

as the other commentator said, it's one thing if it's just variable names (opaque to reverse engineering) but the fact that it is registry keys....

	▲	qarl an hour ago \| parent [-]
		You make a compelling argument.

▲

rep_lodsb 2 hours ago | parent | prev [-]

And the Wikipedia article explains where the name came from, a combination of ".stub" and "mrxnet.sys".

Not one literal string as it appears several times in this purported "reconstruction". Including as the name for a registry key, in the hex code at the end of an EXE header stub ("REALTEK",0x00,"Stuxnet"), and in a frigging autorun.inf as the program name.

Even if Wikipedia is wrong and that string should appear somewhere in the original binary, whatever LLM they used has really been overdoing it beyond the bounds of realism: "Hey look, it's the REAL STUXNET, you've all read about it, here is the 100% real authentic reverse-engineered source code!"

	▲	qarl an hour ago \| parent [-]
		Yeah... you've convinced me. An reverse engineering LLM should/would never invent literal strings in the code.

▲ nullbio 3 hours ago | parent | prev [-]

Astra can reverse engineer binaries now. That's likely where it came from.

▲ rep_lodsb 2 hours ago | parent | next [-]

But then did it hallucinate that registry key? Or this?

        "instance of ActiveScriptEventConsumer as $Consumer\n"
        "{\n"
        "    Name = \"StuxnetConsumer\";\n"
        "    ScriptingEngine = \"VBScript\";\n"
        "    ScriptText = \"CreateObject(\\\"WScript.Shell\\\").Run \\\"%SystemRoot%\\\\system32\\\\winsta.exe\\\", 0, False\";\n"
        "};\n"

	▲	CMDDestory 16 minutes ago \| parent [-]
		As for the issues concerning WMI and the Run registry key, I am fully aware of the seriousness of these matters. This is merely a demonstrative demo code, so please just refer to it normally!

▲ 2 hours ago | parent | prev [-]

[deleted]