According to the Iranian CERT team none of their 43 detection tools could find it originally
http://www.certcc.ir/index.php?name=news&file=article&sid=1894
Looks like the CERT team in Budapest actually identified it
http://www.crysys.hu/