OSINT - UNC2452 / SUNBURST @vxunderground OSINT related findings
The provided information relates to OSINT findings concerning the UNC2452 threat actor and the SUNBURST malware, known from the SolarWinds supply chain compromise. This entry is an OSINT report with moderate certainty (50%) and no specific technical details or affected product versions. No patches or known exploits in the wild are indicated. The threat is categorized under OSINT, payload delivery, and external analysis, with a high severity tag but lacks concrete exploit or vulnerability data. The lack of detailed technical information and absence of confirmed exploits limit precise impact assessment. European organizations using SolarWinds products or connected to affected supply chains remain at risk. Mitigation should focus on monitoring, threat intelligence integration, and supply chain security. Countries with significant SolarWinds usage and strategic IT infrastructure are more likely to be affected. Given the indirect nature and limited data, the suggested severity is medium.
AI Analysis
Technical Summary
This report references OSINT findings related to the UNC2452 threat actor and the SUNBURST malware, which gained notoriety through the SolarWinds supply chain attack disclosed in late 2020. UNC2452 is a sophisticated threat actor believed to be state-sponsored, responsible for injecting malicious code into SolarWinds Orion software updates, enabling widespread espionage and data exfiltration. The provided data is an OSINT feed entry from CIRCL, indicating a 50% certainty level and categorizing the information as perpetual OSINT. No specific affected versions or technical exploit details are provided, nor are there known exploits in the wild linked to this particular OSINT entry. The lack of patch availability and absence of CWE identifiers suggest this entry is informational rather than a direct vulnerability report. The threat's high severity tag likely reflects the known impact of the underlying SUNBURST compromise rather than new findings. The report's focus on payload delivery and external analysis aligns with the known modus operandi of UNC2452, which used sophisticated supply chain attacks to deliver malicious payloads stealthily. Overall, this entry serves as a pointer to ongoing OSINT efforts monitoring UNC2452/SUNBURST activity rather than a new or distinct vulnerability.
Potential Impact
For European organizations, the impact of the UNC2452/SUNBURST threat is significant due to the potential for widespread espionage, data theft, and disruption of critical infrastructure. Organizations using SolarWinds Orion products or integrated supply chain services are at risk of having been compromised or targeted. The stealthy nature of the attack allows threat actors to maintain persistence and exfiltrate sensitive data over extended periods, potentially affecting government agencies, critical infrastructure providers, and private enterprises. The lack of specific exploit details in this OSINT entry limits immediate actionable impact but underscores the ongoing risk from this threat actor. European entities involved in IT management, telecommunications, energy, and public administration are particularly vulnerable due to their reliance on SolarWinds products and the strategic value of their data. The reputational damage and operational disruption from such supply chain compromises can be severe, affecting trust and compliance with data protection regulations such as GDPR.
Mitigation Recommendations
European organizations should implement enhanced monitoring for indicators of compromise related to UNC2452 and SUNBURST, including network traffic analysis and endpoint detection for known SUNBURST signatures. Conduct thorough audits of SolarWinds Orion deployments and related supply chain components, ensuring all software is updated to versions released after the compromise was disclosed. Employ threat intelligence feeds to stay informed about emerging indicators and tactics used by UNC2452. Strengthen supply chain risk management by vetting third-party vendors and enforcing strict code integrity checks. Implement network segmentation to limit lateral movement in case of compromise. Use multi-factor authentication and least privilege principles to reduce attack surface. Engage in incident response planning specific to supply chain attacks and consider collaboration with national cybersecurity agencies for threat sharing. Given the absence of patches in this OSINT entry, focus on detection and containment rather than remediation of a new vulnerability.
Affected Countries
United Kingdom, Germany, France, Netherlands, Italy, Spain, Belgium, Sweden, Poland
Indicators of Compromise
- hash: 1acf3108bf1e376c8848fbb25dc87424f2c2a39c
- hash: e257236206e99f5a5c62035c9c59c57206728b28
- hash: bcb5a4dcbc60d26a5f619518f2cfc1b4bb4e4387
- hash: 5e643654179e8b4cfe1d3c1906a90a4c8d611cea
- hash: ebe711516d0f5cd8126f4d53e375c90b7b95e8f2
- link: https://vxug.fakedoma.in/samples/Exotic/UNC2452/SolarWinds%20Breach/
- text: .text
- size-in-bytes: 1018368
- float: 5.5695446259584
- hash: 5a1c26db5b9b9a2d0a630e63ff83f0bf
- hash: 18ea74745f5c8992a95ae40bfe2158c8d7e34acf
- hash: 02811d870295f78bf9aa3c9f42ca11f2838171fe73e70dbbc158fae590161573
- hash: c0e04da710f18443018aeef4ab387903f93f95a42b700a3a88b3ea7c35ae3821850f1583494172f5650a69a9acf8f9d63d1fca22aac115f1fdc4ec8b78c5d7e6
- ssdeep: 12288:6JKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+BYvjenWHuhh9c0g8vkzK19QU:KEfDbO97P8TrK0YbenWH4c0g8vkzK19b
- text: .rsrc
- size-in-bytes: 1536
- float: 3.3927625723408
- hash: da27d86acfb9504441eebac21f66a5df
- hash: 939387cdbb29755bf192c2bfce2701c1a27354a6
- hash: 016bbefdcbda1e07eca63a07fabe2dad2b25a4b78cd0bc6564c6d0ad3a6b7523
- hash: 713dece3f4687ea6e4591a7e9e3975ce0bfae2dda5a742b29e78ee5088ae148992995373177a1d5583c6da4877c99e813ba440e386705c2bd7b1ea8c2058e498
- ssdeep: 24:YE66ZyxF4iPXOL1+N0MnaOL1hyYinXF4OL1F3YOL15PNMMDqMM:YrjleBw0MjBhyXBB9hB7MM2MM
- text: .reloc
- size-in-bytes: 512
- float: 1.9473387961876
- hash: a29f1db3dd779a4a629939ffeaa3835b
- hash: c306017f3277b148c4a8914a6c4e46abc1496c94
- hash: 6743e59441d06b5b27d6c2c9cc28ba3e4e81d8955aa0ecde9233cfac0b6e019b
- hash: 17a273facc124e6696eb6e1dc7c1c81c7dd478f2bff5b9160b6678dca0e460235b1f4a013e49f389a1d8d06bc0ca4471500219ee85e533a64afd2441f9bccef3
- ssdeep: 3:6/Pl:6/d
- text: dll
- text: 269460022
- datetime: 2020-05-11T21:32:40+00:00
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2020.2.5300.12432
- text: 000004b0
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2020.2.5300.12432
- text: SolarWinds Worldwide, LLC.
- text: Copyright © 1999-2020 SolarWinds Worldwide, LLC. All Rights Reserved.
- counter: 3
- file: ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6
- size-in-bytes: 1028072
- float: 5.5800537860468
- hash: 846e27a652a5e1bfbd0ddd38a16dc865
- hash: d130bd75645c2433f88ac03e73395fba172ef676
- hash: ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6
- hash: c26e275b4232be844f6c4062a4f42413099452085060ed4080b880b52800428cd32f69271c98977fa979a89355fbb3b485855ca3d51499bca12dfbf8c3168d2f
- malware-sample: ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6|846e27a652a5e1bfbd0ddd38a16dc865
- mime-type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
- ssdeep: 12288:5JKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+BYvjenWHuhh9c0g8vkzK19Q:vEfDbO97P8TrK0YbenWH4c0g8vkzK19
- text: .text
- size-in-bytes: 924672
- float: 5.6441844251496
- hash: cf450191b90401e1015aa2433d7d0b47
- hash: e812fddc3c622905954663d30b25fa8adcca6850
- hash: e29b19ea0c58095c3ab7a19374734bba58effb01498c3f748824fed32326cb06
- hash: 612f4238bbf10e162cf33b6ec9e69d975fb67a1f78f9a6f5436460fcd7664909ab2aaceaa4466eaafdde23b62e2dffe51a4e5addcfc028211c77981f0d6f9d13
- ssdeep: 24576:GdBfeHcrhCECR1R/zoi8SHoN0W8vB8O3IcL:qe8nK/zopSHoN0W8vB8u
- text: .rsrc
- size-in-bytes: 1536
- float: 3.3987008123389
- hash: 005f91999efb988bc401181d2cf103de
- hash: 3a6f37bdbd8f812efd0805a5e14f468da79832cc
- hash: 4497bf92f774c9d57a1ad1cf5842e82c94efe82adb78ff3a90a015376361b284
- hash: 3da3a9c6f0e53126d2c2723262dbfb08716c02af82157a952da7f2d66540fafabe8db2e2f7c8091ec68f4463feb070bb37ae1b54c91a1d0a07fdf98a5518192e
- ssdeep: 24:LXsfQMKyxF4iPXOL1XNN9aOL1hninXF4OL1F3YOL1sPNelvq:LXsnjleBHJBhmBB9hB86i
- text: .reloc
- size-in-bytes: 512
- float: 1.9473387961876
- hash: 32e87d188187fe9b9f6afd9de48a41d6
- hash: 2e10d4aa9df60691736123b143dc3e1dc677330a
- hash: ca16d1bd56e607403c1b0b5d74c6dc3b8366fa3d982146cc0ec2948099ecfbad
- hash: 8e56b8ec1f8828ac8eef7bb7758987aad8f09be39ae0873c2c1ccefa49b8416a48787488ce21c96159cfa536f881151a3372e1cba0dc40b59f338329287fc010
- ssdeep: 3:HlZn:r
- text: dll
- text: 269367810
- datetime: 2019-10-10T13:26:39+00:00
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2019.4.5200.8890
- text: 000004b0
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2019.4.5200.8890
- text: SolarWinds Worldwide, LLC.
- text: Copyright © 1999-2019 SolarWinds Worldwide, LLC. All Rights Reserved.
- counter: 3
- file: a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc
- size-in-bytes: 934232
- float: 5.6560901874991
- hash: e18a6a21eb44e77ca8d739a72209c370
- hash: 5e643654179e8b4cfe1d3c1906a90a4c8d611cea
- hash: a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc
- hash: 17b4de6158de054c02849bb728b9767208d3f07ef18d4dc41963a370d34e9dbcf7cc4b729726903f1a7afd4ef7e8c1d781c20a3049a2c160dede23614352f11c
- malware-sample: a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc|e18a6a21eb44e77ca8d739a72209c370
- mime-type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
- ssdeep: 24576:ldBfeHcrhCECR1R/zoi8SHoN0W8vB8O3Icu:5e8nK/zopSHoN0W8vB83
- text: .text
- size-in-bytes: 1018368
- float: 5.5694865540978
- hash: 26ec41a94ea4d2a3fbfebbe0a32cfa0b
- hash: c83bb058abe34b411897a5feea274a4926ec20da
- hash: 6127115190de534d0f57f23add63dbc8c414ed99789644c1fa7e932cdbb01519
- hash: b4b49fe5725fe8807331672049dd4804929da896e63181eb7022825331fa64ec0eb18dd33c112688e23062b77248adf307151a3bcf71bd1816f5f79640abdc2f
- ssdeep: 12288:6JKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+cYvjenWHuhh9c0g8vkzE19Wa:KEfDbO97P8TrKhYbenWH4c0g8vkzE19j
- text: .rsrc
- size-in-bytes: 1536
- float: 3.389713791853
- hash: 9bd1855b2d66ddb1fb9bfb0be0907ac2
- hash: d0b5359a9a5744d632dbd321ca3a00c1a3f547b9
- hash: 7871935602a9354b0d04469b185dd7f20ddd0d80f45dd7946d6315c7352b8d8c
- hash: 24b2c0c16a3e87a2469bf3315a59153f5ffb74518b50a1ee25cde89f81b919489dca38188f32ebe78b8d488dc30c291ebec665360240d926d297afba89942630
- ssdeep: 24:YA66ZyxF4iPXOL1+N0ZaaOL1hyYinXF4OL1F3YOL15PNMZkqMZ:YPjleBw0gBhyXBB9hB7MzM
- text: .reloc
- size-in-bytes: 512
- float: 1.9473387961876
- hash: a29f1db3dd779a4a629939ffeaa3835b
- hash: c306017f3277b148c4a8914a6c4e46abc1496c94
- hash: 6743e59441d06b5b27d6c2c9cc28ba3e4e81d8955aa0ecde9233cfac0b6e019b
- hash: 17a273facc124e6696eb6e1dc7c1c81c7dd478f2bff5b9160b6678dca0e460235b1f4a013e49f389a1d8d06bc0ca4471500219ee85e533a64afd2441f9bccef3
- ssdeep: 3:6/Pl:6/d
- text: dll
- text: 269460022
- datetime: 2020-04-21T14:53:33+00:00
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2020.2.5200.12394
- text: 000004b0
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2020.2.5200.12394
- text: SolarWinds Worldwide, LLC.
- text: Copyright © 1999-2020 SolarWinds Worldwide, LLC. All Rights Reserved.
- counter: 3
- file: 019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134
- size-in-bytes: 1028072
- float: 5.5799968662039
- hash: 2c4a910a1299cdae2a4e55988a2f102e
- hash: 2f1a5a7411d015d01aaee4535835400191645023
- hash: 019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134
- hash: 5cbfefe612a40c8872a0faf3db8d3835dc514fb3df159610095b47c595c6caa1ada79cce2b10fb99e648990c3f54f63344d1fa7025090bfcd4e2c55d7210a28d
- malware-sample: 019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134|2c4a910a1299cdae2a4e55988a2f102e
- mime-type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
- ssdeep: 12288:dJKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+cYvjenWHuhh9c0g8vkzE19Wv:rEfDbO97P8TrKhYbenWH4c0g8vkzE19e
- text: .text
- size-in-bytes: 1001472
- float: 5.5697311444704
- hash: c4a55257e26e3b07339fa125f5223a72
- hash: 6c2e6a1b9ebb7d0eedb9e11d8017ff6c795b9b98
- hash: 9e1e82ad740aba788850c5529e3eb84681b0a53b6c76ff5eadc6cb762823dba3
- hash: 131e0b4fff35499da6e33f099f8fe96de1a65deec9522becbc8e55d0470f42f8d58cc2f3678eb2a82667bdcd96ed0f587464917290904f989678788a497849db
- ssdeep: 12288:0x7m/z9aEBzvnvLtYAi6uLlYQ69BBpIvF1tjpH7BKi+0A8vca9owY:PaEBTvRBi6uL6dIvDtjpH9+0A8vca9oj
- text: .rsrc
- size-in-bytes: 1536
- float: 3.4018646666713
- hash: 7454e0d2a852d8d802490dbc6c07f42e
- hash: b54275dd4daaa9467f91955b5b4670c20dfc4e49
- hash: e63d0b1280cd09f3d9236c4a7e428a000f0f87c6a707dbe2a6b5df3ceb24b48d
- hash: d982e2edba71923c7f9c4fdff636995fb475ba4146ea66dcb28b2b24c0e7f81742b4109ee9900ae7f9442ded32f1412311766cd374d88abdff2da317f752708d
- ssdeep: 24:wpyQMKyxF4iPXOL1XNNP+aOL1hyYinXF4OL1F3YOL1sPN3Flvq3:wp2jleBHSBhyXBB9hB8Pi
- text: .reloc
- size-in-bytes: 512
- float: 1.9473387961876
- hash: 89642b60883c693211567f54fcde5631
- hash: 0161b4dc14ed849384714b7d48e4ce8e31cee22d
- hash: 7e9191e9c1bd9624a97b0147d173abe2556a3b319dc1e1805d6ca2abc49c054b
- hash: 32837f59e1063a10eff10e71f8ab2f78205122c136ac48bd1e73cb877b375da94c4f6553e84a7080c3a36b8af4461efad16ab251c2c777100b69fb44826aa3cf
- ssdeep: 3:L:L
- text: dll
- text: 269443494
- datetime: 2020-03-24T08:52:34+00:00
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2019.4.5200.9083
- text: 000004b0
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2019.4.5200.9083
- text: SolarWinds Worldwide, LLC.
- text: Copyright © 1999-2020 SolarWinds Worldwide, LLC. All Rights Reserved.
- counter: 3
- file: 32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77
- size-in-bytes: 1011032
- float: 5.5828269967379
- hash: b91ce2fa41029f6955bff20079468448
- hash: 76640508b1e7759e548771a5359eaed353bf1eec
- hash: 32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77
- hash: 6a81f082f36ccbda48070772c5a97e1d7de61ad77465e7befe8cbd97df40dcc5da09c461311708e3d57527e323484b05cfd3e72a3c70e106e47f44cc77584bd7
- malware-sample: 32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77|b91ce2fa41029f6955bff20079468448
- mime-type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
- ssdeep: 12288:Zx7m/z9aEBzvnvLtYAi6uLlYQ69BBpIvF1tjpH7BKi+0A8vca9owQ:6aEBTvRBi6uL6dIvDtjpH9+0A8vca9oD
- text: .text
- size-in-bytes: 5632
- float: 5.4919156876928
- hash: 2109d02a31c7032f2bcabdf436b6726e
- hash: 84d90343ae39a961e9e0f92127333b9cc9d62d33
- hash: f04e002613102c556260dc57c5accb5db70b427a9c2fdd6f51419ff53499f173
- hash: 3c343696c837d1efc28ae4a688b863c4dff41e3b80047cd2ec6c9d571a3f677f8c750a5dabc7530c56d04749e0972d4d13403f05d10635a69ac82707bc984f8d
- ssdeep: 96:DKQSUZZa5aE8ibv1c8M1UBDawAjNXe+U8w15Gl+5DDGTBNF82gx:vqRzbt0GBDawA5uT8wSlyDDGTBNFS
- text: .rsrc
- size-in-bytes: 1024
- float: 3.1419883961028
- hash: 27193464e3effc6950cde66a4ad4757a
- hash: 01d5d5696eadc1963ccbbf7ff2f79ba482ed17e1
- hash: a4c3bc5b8ba65bfff823212b5f2d76f618cbb12fd1e17db85ed1bbff35783336
- hash: 394e55d211fd73d6d5a5aaabeeb6f0330cd6b6fba40a07bcdd789976097875da6d130ba8308478a1991d0217f0b22b0159f07232e7119dc36367784b176ae1e7
- ssdeep: 12:Essi3ntuAHeswYAB19aUGiqMZAiN5Eryi1qD41hPvYnqqf1qD41hoPN5Dlq5J:lIfs1FuZhNu8+PWN8+oPNnqX
- text: .reloc
- size-in-bytes: 512
- float: 1.5849625007212
- hash: 6a8e92fdd78e813e24abd0a0932052b9
- hash: 76e3423312516772e053f5d1861163dd27e99a8c
- hash: f81e587fb1c7b55c7daeeee2bca68e619df3c815b316e439ef006fd91894aa09
- hash: e91dae684ce94faddd8a4b69d745524f15494f22a55b87d4ef1dd5fa3b78e017a911d55148819ca2736e4c500742f82584dbb6cb9aa3a0b61fadf91a56b0dc3c
- ssdeep: 3:n:n
- text: dll
- text: 268448958
- datetime: 2020-03-24T09:16:10+00:00
- file: App_Web_logoimagehandler.ashx.b6031896.dll
- file: App_Web_logoimagehandler.ashx.b6031896.dll
- text: 0.0.0.0
- text: 000004b0
- text: 0.0.0.0
- counter: 3
- file: c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71
- size-in-bytes: 7680
- float: 4.6224498216263
- hash: 56ceb6d0011d87b6e4d7023d7ef85676
- hash: 75af292f34789a1c782ea36c7127bf6106f595e8
- hash: c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71
- hash: f7eac6ab99fe45ca46417cdca36ba27560d5f8a2f37f378ba97636662595d55fa34f749716971aa96a862e37e0199eb6cb905636e6ab0123cfa089adba450629
- malware-sample: c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71|56ceb6d0011d87b6e4d7023d7ef85676
- mime-type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
- ssdeep: 192:8/SqRzbt0GBDawA5uT8wSlyDDGTBNFkQ:8/SyHKGBDax5uThDD6BNr
- hash: 3e329a4c9030b26ba152fb602a1d5893
- hash: ebe711516d0f5cd8126f4d53e375c90b7b95e8f2
- hash: d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af
- datetime: 2020-12-14T06:35:21+00:00
- link: https://www.virustotal.com/gui/file/d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af/detection/f-d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af-1607927721
- text: 0/70
- datetime: 2020-12-14T06:24:36+00:00
- link: https://www.virustotal.com/gui/file/019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134/detection/f-019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134-1607927076
- text: 4/69
- datetime: 2020-12-14T06:47:17+00:00
- link: https://www.virustotal.com/gui/file/c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71/detection/f-c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71-1607928437
- text: 2/69
- datetime: 2020-12-14T07:32:31+00:00
- link: https://www.virustotal.com/gui/file/32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77/detection/f-32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77-1607931151
- text: 5/69
- datetime: 2020-12-14T07:28:34+00:00
- link: https://www.virustotal.com/gui/file/ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6/detection/f-ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6-1607930914
- text: 6/70
OSINT - UNC2452 / SUNBURST @vxunderground OSINT related findings
Description
The provided information relates to OSINT findings concerning the UNC2452 threat actor and the SUNBURST malware, known from the SolarWinds supply chain compromise. This entry is an OSINT report with moderate certainty (50%) and no specific technical details or affected product versions. No patches or known exploits in the wild are indicated. The threat is categorized under OSINT, payload delivery, and external analysis, with a high severity tag but lacks concrete exploit or vulnerability data. The lack of detailed technical information and absence of confirmed exploits limit precise impact assessment. European organizations using SolarWinds products or connected to affected supply chains remain at risk. Mitigation should focus on monitoring, threat intelligence integration, and supply chain security. Countries with significant SolarWinds usage and strategic IT infrastructure are more likely to be affected. Given the indirect nature and limited data, the suggested severity is medium.
AI-Powered Analysis
Technical Analysis
This report references OSINT findings related to the UNC2452 threat actor and the SUNBURST malware, which gained notoriety through the SolarWinds supply chain attack disclosed in late 2020. UNC2452 is a sophisticated threat actor believed to be state-sponsored, responsible for injecting malicious code into SolarWinds Orion software updates, enabling widespread espionage and data exfiltration. The provided data is an OSINT feed entry from CIRCL, indicating a 50% certainty level and categorizing the information as perpetual OSINT. No specific affected versions or technical exploit details are provided, nor are there known exploits in the wild linked to this particular OSINT entry. The lack of patch availability and absence of CWE identifiers suggest this entry is informational rather than a direct vulnerability report. The threat's high severity tag likely reflects the known impact of the underlying SUNBURST compromise rather than new findings. The report's focus on payload delivery and external analysis aligns with the known modus operandi of UNC2452, which used sophisticated supply chain attacks to deliver malicious payloads stealthily. Overall, this entry serves as a pointer to ongoing OSINT efforts monitoring UNC2452/SUNBURST activity rather than a new or distinct vulnerability.
Potential Impact
For European organizations, the impact of the UNC2452/SUNBURST threat is significant due to the potential for widespread espionage, data theft, and disruption of critical infrastructure. Organizations using SolarWinds Orion products or integrated supply chain services are at risk of having been compromised or targeted. The stealthy nature of the attack allows threat actors to maintain persistence and exfiltrate sensitive data over extended periods, potentially affecting government agencies, critical infrastructure providers, and private enterprises. The lack of specific exploit details in this OSINT entry limits immediate actionable impact but underscores the ongoing risk from this threat actor. European entities involved in IT management, telecommunications, energy, and public administration are particularly vulnerable due to their reliance on SolarWinds products and the strategic value of their data. The reputational damage and operational disruption from such supply chain compromises can be severe, affecting trust and compliance with data protection regulations such as GDPR.
Mitigation Recommendations
European organizations should implement enhanced monitoring for indicators of compromise related to UNC2452 and SUNBURST, including network traffic analysis and endpoint detection for known SUNBURST signatures. Conduct thorough audits of SolarWinds Orion deployments and related supply chain components, ensuring all software is updated to versions released after the compromise was disclosed. Employ threat intelligence feeds to stay informed about emerging indicators and tactics used by UNC2452. Strengthen supply chain risk management by vetting third-party vendors and enforcing strict code integrity checks. Implement network segmentation to limit lateral movement in case of compromise. Use multi-factor authentication and least privilege principles to reduce attack surface. Engage in incident response planning specific to supply chain attacks and consider collaboration with national cybersecurity agencies for threat sharing. Given the absence of patches in this OSINT entry, focus on detection and containment rather than remediation of a new vulnerability.
Affected Countries
Technical Details
- Uuid
- f78232e7-0b7a-49f7-9e57-1482db2b6335
- Original Timestamp
- 1607931286
Indicators of Compromise
Hash
| Value | Description | Copy |
|---|---|---|
hash1acf3108bf1e376c8848fbb25dc87424f2c2a39c | — | |
hashe257236206e99f5a5c62035c9c59c57206728b28 | — | |
hashbcb5a4dcbc60d26a5f619518f2cfc1b4bb4e4387 | — | |
hash5e643654179e8b4cfe1d3c1906a90a4c8d611cea | — | |
hashebe711516d0f5cd8126f4d53e375c90b7b95e8f2 | — | |
hash5a1c26db5b9b9a2d0a630e63ff83f0bf | — | |
hash18ea74745f5c8992a95ae40bfe2158c8d7e34acf | — | |
hash02811d870295f78bf9aa3c9f42ca11f2838171fe73e70dbbc158fae590161573 | — | |
hashc0e04da710f18443018aeef4ab387903f93f95a42b700a3a88b3ea7c35ae3821850f1583494172f5650a69a9acf8f9d63d1fca22aac115f1fdc4ec8b78c5d7e6 | — | |
hashda27d86acfb9504441eebac21f66a5df | — | |
hash939387cdbb29755bf192c2bfce2701c1a27354a6 | — | |
hash016bbefdcbda1e07eca63a07fabe2dad2b25a4b78cd0bc6564c6d0ad3a6b7523 | — | |
hash713dece3f4687ea6e4591a7e9e3975ce0bfae2dda5a742b29e78ee5088ae148992995373177a1d5583c6da4877c99e813ba440e386705c2bd7b1ea8c2058e498 | — | |
hasha29f1db3dd779a4a629939ffeaa3835b | — | |
hashc306017f3277b148c4a8914a6c4e46abc1496c94 | — | |
hash6743e59441d06b5b27d6c2c9cc28ba3e4e81d8955aa0ecde9233cfac0b6e019b | — | |
hash17a273facc124e6696eb6e1dc7c1c81c7dd478f2bff5b9160b6678dca0e460235b1f4a013e49f389a1d8d06bc0ca4471500219ee85e533a64afd2441f9bccef3 | — | |
hash846e27a652a5e1bfbd0ddd38a16dc865 | — | |
hashd130bd75645c2433f88ac03e73395fba172ef676 | — | |
hashce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6 | — | |
hashc26e275b4232be844f6c4062a4f42413099452085060ed4080b880b52800428cd32f69271c98977fa979a89355fbb3b485855ca3d51499bca12dfbf8c3168d2f | — | |
hashcf450191b90401e1015aa2433d7d0b47 | — | |
hashe812fddc3c622905954663d30b25fa8adcca6850 | — | |
hashe29b19ea0c58095c3ab7a19374734bba58effb01498c3f748824fed32326cb06 | — | |
hash612f4238bbf10e162cf33b6ec9e69d975fb67a1f78f9a6f5436460fcd7664909ab2aaceaa4466eaafdde23b62e2dffe51a4e5addcfc028211c77981f0d6f9d13 | — | |
hash005f91999efb988bc401181d2cf103de | — | |
hash3a6f37bdbd8f812efd0805a5e14f468da79832cc | — | |
hash4497bf92f774c9d57a1ad1cf5842e82c94efe82adb78ff3a90a015376361b284 | — | |
hash3da3a9c6f0e53126d2c2723262dbfb08716c02af82157a952da7f2d66540fafabe8db2e2f7c8091ec68f4463feb070bb37ae1b54c91a1d0a07fdf98a5518192e | — | |
hash32e87d188187fe9b9f6afd9de48a41d6 | — | |
hash2e10d4aa9df60691736123b143dc3e1dc677330a | — | |
hashca16d1bd56e607403c1b0b5d74c6dc3b8366fa3d982146cc0ec2948099ecfbad | — | |
hash8e56b8ec1f8828ac8eef7bb7758987aad8f09be39ae0873c2c1ccefa49b8416a48787488ce21c96159cfa536f881151a3372e1cba0dc40b59f338329287fc010 | — | |
hashe18a6a21eb44e77ca8d739a72209c370 | — | |
hash5e643654179e8b4cfe1d3c1906a90a4c8d611cea | — | |
hasha25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc | — | |
hash17b4de6158de054c02849bb728b9767208d3f07ef18d4dc41963a370d34e9dbcf7cc4b729726903f1a7afd4ef7e8c1d781c20a3049a2c160dede23614352f11c | — | |
hash26ec41a94ea4d2a3fbfebbe0a32cfa0b | — | |
hashc83bb058abe34b411897a5feea274a4926ec20da | — | |
hash6127115190de534d0f57f23add63dbc8c414ed99789644c1fa7e932cdbb01519 | — | |
hashb4b49fe5725fe8807331672049dd4804929da896e63181eb7022825331fa64ec0eb18dd33c112688e23062b77248adf307151a3bcf71bd1816f5f79640abdc2f | — | |
hash9bd1855b2d66ddb1fb9bfb0be0907ac2 | — | |
hashd0b5359a9a5744d632dbd321ca3a00c1a3f547b9 | — | |
hash7871935602a9354b0d04469b185dd7f20ddd0d80f45dd7946d6315c7352b8d8c | — | |
hash24b2c0c16a3e87a2469bf3315a59153f5ffb74518b50a1ee25cde89f81b919489dca38188f32ebe78b8d488dc30c291ebec665360240d926d297afba89942630 | — | |
hasha29f1db3dd779a4a629939ffeaa3835b | — | |
hashc306017f3277b148c4a8914a6c4e46abc1496c94 | — | |
hash6743e59441d06b5b27d6c2c9cc28ba3e4e81d8955aa0ecde9233cfac0b6e019b | — | |
hash17a273facc124e6696eb6e1dc7c1c81c7dd478f2bff5b9160b6678dca0e460235b1f4a013e49f389a1d8d06bc0ca4471500219ee85e533a64afd2441f9bccef3 | — | |
hash2c4a910a1299cdae2a4e55988a2f102e | — | |
hash2f1a5a7411d015d01aaee4535835400191645023 | — | |
hash019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134 | — | |
hash5cbfefe612a40c8872a0faf3db8d3835dc514fb3df159610095b47c595c6caa1ada79cce2b10fb99e648990c3f54f63344d1fa7025090bfcd4e2c55d7210a28d | — | |
hashc4a55257e26e3b07339fa125f5223a72 | — | |
hash6c2e6a1b9ebb7d0eedb9e11d8017ff6c795b9b98 | — | |
hash9e1e82ad740aba788850c5529e3eb84681b0a53b6c76ff5eadc6cb762823dba3 | — | |
hash131e0b4fff35499da6e33f099f8fe96de1a65deec9522becbc8e55d0470f42f8d58cc2f3678eb2a82667bdcd96ed0f587464917290904f989678788a497849db | — | |
hash7454e0d2a852d8d802490dbc6c07f42e | — | |
hashb54275dd4daaa9467f91955b5b4670c20dfc4e49 | — | |
hashe63d0b1280cd09f3d9236c4a7e428a000f0f87c6a707dbe2a6b5df3ceb24b48d | — | |
hashd982e2edba71923c7f9c4fdff636995fb475ba4146ea66dcb28b2b24c0e7f81742b4109ee9900ae7f9442ded32f1412311766cd374d88abdff2da317f752708d | — | |
hash89642b60883c693211567f54fcde5631 | — | |
hash0161b4dc14ed849384714b7d48e4ce8e31cee22d | — | |
hash7e9191e9c1bd9624a97b0147d173abe2556a3b319dc1e1805d6ca2abc49c054b | — | |
hash32837f59e1063a10eff10e71f8ab2f78205122c136ac48bd1e73cb877b375da94c4f6553e84a7080c3a36b8af4461efad16ab251c2c777100b69fb44826aa3cf | — | |
hashb91ce2fa41029f6955bff20079468448 | — | |
hash76640508b1e7759e548771a5359eaed353bf1eec | — | |
hash32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77 | — | |
hash6a81f082f36ccbda48070772c5a97e1d7de61ad77465e7befe8cbd97df40dcc5da09c461311708e3d57527e323484b05cfd3e72a3c70e106e47f44cc77584bd7 | — | |
hash2109d02a31c7032f2bcabdf436b6726e | — | |
hash84d90343ae39a961e9e0f92127333b9cc9d62d33 | — | |
hashf04e002613102c556260dc57c5accb5db70b427a9c2fdd6f51419ff53499f173 | — | |
hash3c343696c837d1efc28ae4a688b863c4dff41e3b80047cd2ec6c9d571a3f677f8c750a5dabc7530c56d04749e0972d4d13403f05d10635a69ac82707bc984f8d | — | |
hash27193464e3effc6950cde66a4ad4757a | — | |
hash01d5d5696eadc1963ccbbf7ff2f79ba482ed17e1 | — | |
hasha4c3bc5b8ba65bfff823212b5f2d76f618cbb12fd1e17db85ed1bbff35783336 | — | |
hash394e55d211fd73d6d5a5aaabeeb6f0330cd6b6fba40a07bcdd789976097875da6d130ba8308478a1991d0217f0b22b0159f07232e7119dc36367784b176ae1e7 | — | |
hash6a8e92fdd78e813e24abd0a0932052b9 | — | |
hash76e3423312516772e053f5d1861163dd27e99a8c | — | |
hashf81e587fb1c7b55c7daeeee2bca68e619df3c815b316e439ef006fd91894aa09 | — | |
hashe91dae684ce94faddd8a4b69d745524f15494f22a55b87d4ef1dd5fa3b78e017a911d55148819ca2736e4c500742f82584dbb6cb9aa3a0b61fadf91a56b0dc3c | — | |
hash56ceb6d0011d87b6e4d7023d7ef85676 | — | |
hash75af292f34789a1c782ea36c7127bf6106f595e8 | — | |
hashc15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71 | — | |
hashf7eac6ab99fe45ca46417cdca36ba27560d5f8a2f37f378ba97636662595d55fa34f749716971aa96a862e37e0199eb6cb905636e6ab0123cfa089adba450629 | — | |
hash3e329a4c9030b26ba152fb602a1d5893 | — | |
hashebe711516d0f5cd8126f4d53e375c90b7b95e8f2 | — | |
hashd3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af | — |
Link
| Value | Description | Copy |
|---|---|---|
linkhttps://vxug.fakedoma.in/samples/Exotic/UNC2452/SolarWinds%20Breach/ | — | |
linkhttps://www.virustotal.com/gui/file/d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af/detection/f-d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af-1607927721 | — | |
linkhttps://www.virustotal.com/gui/file/019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134/detection/f-019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134-1607927076 | — | |
linkhttps://www.virustotal.com/gui/file/c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71/detection/f-c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71-1607928437 | — | |
linkhttps://www.virustotal.com/gui/file/32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77/detection/f-32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77-1607931151 | — | |
linkhttps://www.virustotal.com/gui/file/ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6/detection/f-ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6-1607930914 | — |
Text
| Value | Description | Copy |
|---|---|---|
text.text | — | |
text.rsrc | — | |
text.reloc | — | |
textdll | — | |
text269460022 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2020.2.5300.12432 | — | |
text000004b0 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2020.2.5300.12432 | — | |
textSolarWinds Worldwide, LLC. | — | |
textCopyright © 1999-2020 SolarWinds Worldwide, LLC. All Rights Reserved. | — | |
text.text | — | |
text.rsrc | — | |
text.reloc | — | |
textdll | — | |
text269367810 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2019.4.5200.8890 | — | |
text000004b0 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2019.4.5200.8890 | — | |
textSolarWinds Worldwide, LLC. | — | |
textCopyright © 1999-2019 SolarWinds Worldwide, LLC. All Rights Reserved. | — | |
text.text | — | |
text.rsrc | — | |
text.reloc | — | |
textdll | — | |
text269460022 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2020.2.5200.12394 | — | |
text000004b0 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2020.2.5200.12394 | — | |
textSolarWinds Worldwide, LLC. | — | |
textCopyright © 1999-2020 SolarWinds Worldwide, LLC. All Rights Reserved. | — | |
text.text | — | |
text.rsrc | — | |
text.reloc | — | |
textdll | — | |
text269443494 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2019.4.5200.9083 | — | |
text000004b0 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2019.4.5200.9083 | — | |
textSolarWinds Worldwide, LLC. | — | |
textCopyright © 1999-2020 SolarWinds Worldwide, LLC. All Rights Reserved. | — | |
text.text | — | |
text.rsrc | — | |
text.reloc | — | |
textdll | — | |
text268448958 | — | |
text0.0.0.0 | — | |
text000004b0 | — | |
text0.0.0.0 | — | |
text0/70 | — | |
text4/69 | — | |
text2/69 | — | |
text5/69 | — | |
text6/70 | — |
Size in-bytes
| Value | Description | Copy |
|---|---|---|
size-in-bytes1018368 | — | |
size-in-bytes1536 | — | |
size-in-bytes512 | — | |
size-in-bytes1028072 | — | |
size-in-bytes924672 | — | |
size-in-bytes1536 | — | |
size-in-bytes512 | — | |
size-in-bytes934232 | — | |
size-in-bytes1018368 | — | |
size-in-bytes1536 | — | |
size-in-bytes512 | — | |
size-in-bytes1028072 | — | |
size-in-bytes1001472 | — | |
size-in-bytes1536 | — | |
size-in-bytes512 | — | |
size-in-bytes1011032 | — | |
size-in-bytes5632 | — | |
size-in-bytes1024 | — | |
size-in-bytes512 | — | |
size-in-bytes7680 | — |
Float
| Value | Description | Copy |
|---|---|---|
float5.5695446259584 | — | |
float3.3927625723408 | — | |
float1.9473387961876 | — | |
float5.5800537860468 | — | |
float5.6441844251496 | — | |
float3.3987008123389 | — | |
float1.9473387961876 | — | |
float5.6560901874991 | — | |
float5.5694865540978 | — | |
float3.389713791853 | — | |
float1.9473387961876 | — | |
float5.5799968662039 | — | |
float5.5697311444704 | — | |
float3.4018646666713 | — | |
float1.9473387961876 | — | |
float5.5828269967379 | — | |
float5.4919156876928 | — | |
float3.1419883961028 | — | |
float1.5849625007212 | — | |
float4.6224498216263 | — |
Ssdeep
| Value | Description | Copy |
|---|---|---|
ssdeep12288:6JKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+BYvjenWHuhh9c0g8vkzK19QU:KEfDbO97P8TrK0YbenWH4c0g8vkzK19b | — | |
ssdeep24:YE66ZyxF4iPXOL1+N0MnaOL1hyYinXF4OL1F3YOL15PNMMDqMM:YrjleBw0MjBhyXBB9hB7MM2MM | — | |
ssdeep3:6/Pl:6/d | — | |
ssdeep12288:5JKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+BYvjenWHuhh9c0g8vkzK19Q:vEfDbO97P8TrK0YbenWH4c0g8vkzK19 | — | |
ssdeep24576:GdBfeHcrhCECR1R/zoi8SHoN0W8vB8O3IcL:qe8nK/zopSHoN0W8vB8u | — | |
ssdeep24:LXsfQMKyxF4iPXOL1XNN9aOL1hninXF4OL1F3YOL1sPNelvq:LXsnjleBHJBhmBB9hB86i | — | |
ssdeep3:HlZn:r | — | |
ssdeep24576:ldBfeHcrhCECR1R/zoi8SHoN0W8vB8O3Icu:5e8nK/zopSHoN0W8vB83 | — | |
ssdeep12288:6JKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+cYvjenWHuhh9c0g8vkzE19Wa:KEfDbO97P8TrKhYbenWH4c0g8vkzE19j | — | |
ssdeep24:YA66ZyxF4iPXOL1+N0ZaaOL1hyYinXF4OL1F3YOL15PNMZkqMZ:YPjleBw0gBhyXBB9hB7MzM | — | |
ssdeep3:6/Pl:6/d | — | |
ssdeep12288:dJKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+cYvjenWHuhh9c0g8vkzE19Wv:rEfDbO97P8TrKhYbenWH4c0g8vkzE19e | — | |
ssdeep12288:0x7m/z9aEBzvnvLtYAi6uLlYQ69BBpIvF1tjpH7BKi+0A8vca9owY:PaEBTvRBi6uL6dIvDtjpH9+0A8vca9oj | — | |
ssdeep24:wpyQMKyxF4iPXOL1XNNP+aOL1hyYinXF4OL1F3YOL1sPN3Flvq3:wp2jleBHSBhyXBB9hB8Pi | — | |
ssdeep3:L:L | — | |
ssdeep12288:Zx7m/z9aEBzvnvLtYAi6uLlYQ69BBpIvF1tjpH7BKi+0A8vca9owQ:6aEBTvRBi6uL6dIvDtjpH9+0A8vca9oD | — | |
ssdeep96:DKQSUZZa5aE8ibv1c8M1UBDawAjNXe+U8w15Gl+5DDGTBNF82gx:vqRzbt0GBDawA5uT8wSlyDDGTBNFS | — | |
ssdeep12:Essi3ntuAHeswYAB19aUGiqMZAiN5Eryi1qD41hPvYnqqf1qD41hoPN5Dlq5J:lIfs1FuZhNu8+PWN8+oPNnqX | — | |
ssdeep3:n:n | — | |
ssdeep192:8/SqRzbt0GBDawA5uT8wSlyDDGTBNFkQ:8/SyHKGBDax5uThDD6BNr | — |
Datetime
| Value | Description | Copy |
|---|---|---|
datetime2020-05-11T21:32:40+00:00 | — | |
datetime2019-10-10T13:26:39+00:00 | — | |
datetime2020-04-21T14:53:33+00:00 | — | |
datetime2020-03-24T08:52:34+00:00 | — | |
datetime2020-03-24T09:16:10+00:00 | — | |
datetime2020-12-14T06:35:21+00:00 | — | |
datetime2020-12-14T06:24:36+00:00 | — | |
datetime2020-12-14T06:47:17+00:00 | — | |
datetime2020-12-14T07:32:31+00:00 | — | |
datetime2020-12-14T07:28:34+00:00 | — |
File
| Value | Description | Copy |
|---|---|---|
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
filece77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6 | — | |
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
filea25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc | — | |
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
file019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134 | — | |
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
file32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77 | — | |
fileApp_Web_logoimagehandler.ashx.b6031896.dll | — | |
fileApp_Web_logoimagehandler.ashx.b6031896.dll | — | |
filec15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71 | — |
Counter
| Value | Description | Copy |
|---|---|---|
counter3 | — | |
counter3 | — | |
counter3 | — | |
counter3 | — | |
counter3 | — |
Malware sample
| Value | Description | Copy |
|---|---|---|
malware-samplece77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6|846e27a652a5e1bfbd0ddd38a16dc865 | — | |
malware-samplea25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc|e18a6a21eb44e77ca8d739a72209c370 | — | |
malware-sample019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134|2c4a910a1299cdae2a4e55988a2f102e | — | |
malware-sample32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77|b91ce2fa41029f6955bff20079468448 | — | |
malware-samplec15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71|56ceb6d0011d87b6e4d7023d7ef85676 | — |
Mime type
| Value | Description | Copy |
|---|---|---|
mime-typePE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows | — | |
mime-typePE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows | — | |
mime-typePE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows | — | |
mime-typePE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows | — | |
mime-typePE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows | — |
Threat ID: 68359c9e5d5f0974d01fb95e
Added to database: 5/27/2025, 11:06:06 AM
Last enriched: 12/24/2025, 6:11:37 AM
Last updated: 2/7/2026, 3:34:22 AM
Views: 50
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Related Threats
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console in Console -> Billing for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.