Infiltration (dropper/1. Main.c):
Stuxnet infiltrated systems by exploiting vulnerabilities in Windows. It often spread through infected USB drives. When a user plugged the USB into a computer, Stuxnet would use these vulnerabilities to install itself. In the dropper/1. Main.c file, the DllMain function is where this initial infiltration mechanism is initiated. This function sets up the malware in the system after it's been triggered, typically by the insertion of the infected USB.
Staying Hidden (dropper/2. STUBHandler.c):
Once installed, Stuxnet used rootkit techniques to hide its files and processes from antivirus software and the system’s administrators. In dropper/2. STUBHandler.c, the code manages the hiding of Stuxnet's activities, including concealing its files and processes, making the malware invisible to regular detection methods.
Verifying the target (dropper/3. OS.c):
Stuxnet was designed to act under specific conditions. It checked the infected system to determine if it matched its target - typically industrial control systems, particularly those using Siemens software and PLCs. In dropper/3. OS.c, functions like CheckSystemVersion ensure the system is compatible, and potentially, if it matches the target specifications, before proceeding further.
Delivering Payload through PLCs (dropper/6. MemorySections.c and beyond):
real damage was done by manipulating the PLCs controlling the centrifuges. Stuxnet altered the commands sent to these PLCs, causing the centrifuges to spin erratically and eventually fail. In dropper/6. MemorySections.c file likely includes functions for loading the malware's payload into memory, but the specific code targeting PLCs might be in other parts of the codebase that aren't as clearly identified.