Exploit / PoCcritical
A Fanny Equation: “I am your father, Stuxnet”
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2010-2568 | Remote Code Execution in Microsoft Windows via Malicious Shortcut (LNK) Parsing | — | 90% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | webuysupplystore.mooo.com | &C server using a URL which is stored in the config: http://webuysupplystore[.]mooo[.]com/ads/QueryRecord200586_f2ahx.html Below is a sample requ |
| ipv4 | 210.81.22.239 | records it previously pointed to the following IP address: 210.81.22.239 IP information The following describes the stages that were |
| md5 | 0a209ac0de4ac033f31d6ba9191a8f7a | om the USB which take seconds to execute. Fanny modules MD5 0a209ac0de4ac033f31d6ba9191a8f7a Size 184320 Type Win32 DLL Internal name dll_installer.dll |
From the original article
14 min read at securelist.com
At the Virus Bulletin conference in 2010, researchers from Kaspersky Lab partnered with Microsoft to present findings related to Stuxnet. The joint presentation included slides dealing with various parts of Stuxnet, such as the zero-days used in the attack. Perhaps the most interesting zero-day exploit from Stuxnet was the LNK exploit (CVE-2010-2568).
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.