i don't have a dropper only several files from an infected box, but i'm not allowed to share currently.
from what i've seen so far it doesn't contain PLC code. it's more a keylogger, but the codebase and several techniques are very similar to stuxnet code.
if you are lucky and get all needed files you have to prepare your box a little to make it working.
cmi4432.sys and jminet7.sys drivers contain the same code. difference is that one is signed and the other one not.
driver installs a loadimage callback and injects 4 payloads into services.exe stored in PNF files.
there is also a fake lsass.exe, which does the keyboard hooking (WH_KEYBOARD hook).
*.pnf files need to be in %systemroot%\inf
if the driver gets loaded it decryts the pnf files from this directory.
if you wanna analyse the drivers with windbg you first have to bypass the
KDDEBUGGERENABLED check at the beginning of the code.
in order to work properly the drivers need the registry entry:
"FILTER"=hex:a0,35,58,da,32,ee,d5,01,c0,15,8b,1f,4b,5c,d1,a1,0b,8b,e7,85,1c,7f,\
6e,f2,ef,31,6a,18,3c,80,78,c7,d4,c5,50,90,7a,78,66,9d,6b,93,00,a1,f5,3d,26,\
ce,cb,1c,1e,45,b0,ff,a0,dd,c0,a3,e8,58,31,0c,b2,a1,dd,11,37,ba,aa,1e,66,d3,\
1f,b4,2f,e1,7c,eb,b6,a2,58,a0,25,62,77,b5,4c,d3,79,02,07,be,8f,bb,57,43,7c,\
43,b5,d0,67,25,19,10,27,67,a5,15,38,9f,43
all other parameters are straight forward.
the FILTER registry string decrypts to some unicode string information:
services.exe
\SystemRoot\inf\cmi4432.PNF
the pnf files decrypts payload injected into services.exe
md5sums of files i got are:
0a566b1616c8afeef214372b1a0580c7
4541e850a228eb69fd0f0e924624b245
e8d6b4dadb96ddb58775e6c85b10b6cc
0eecd17c6c215b358b7b872b74bfd800
9749d38ae9b9ddd81b50aad679ee87ec
b4ac366e24204d821376653279cbad86
94c4ef91dfcd0c53a96fdc387f9f9c35
