Stairwell - Stuxnet

A worm that targeted Iranian nuclear facilities, widely believed to be state-sponsored.

# Properties

magic	exe
mime type	application/vnd.microsoft.portable-executable
size	26.0 kB
entropy	6.491409779
md5	f81537...72151e
sha1	cb0793...deb4fd
sha256	1635ec...3c555c
imphash	e47929...12abb9
tlsh	6ac26e...735b0f

Internet Results

VirusTotal

www.virustotal.com

VirusTotal.

Malware analysis StuxNet.exe No threats detected | ANY.RUN ...

any.run

... 1635EC04F069CCC8331D01FDF31132A4BC8F6FD3830AC94739DF95EE093C555C. 3484, StuxNet.exe, C:\Users\admin\AppData\Local\Temp\stuxnet core\dropper.exe, executable. MD5 ...

daedalus/StuxNet: Stuxnet sample - GitHub

GitHub

... https://www.virustotal.com/gui/file/1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c/details https://www.virustotal.com/gui/file ...

signature-base/yara/apt_stuxnet.yar at master · Neo23x0/signature ...

GitHub

... 1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c" id = "fd3fa395-15f1-5a11-9740-03b897e4620b" strings: $x1 = "\\objfre_w2k_x86\\i386\\guava ...

rules/malware/APT_Stuxnet.yar at master · Yara-Rules/rules · GitHub

GitHub

... 1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c" strings: $x1 = "\\objfre_w2k_x86\\i386\\guava.pdb" ascii $x2 = "MRxCls.sys" fullword wide ...