OSINT - UNC2452 / SUNBURST @vxunderground OSINT related findings
OSINT - UNC2452 / SUNBURST @vxunderground OSINT related findings
AI Analysis
Technical Summary
The provided information relates to OSINT (Open Source Intelligence) findings concerning the threat actor UNC2452, also known as SUNBURST. UNC2452 is widely recognized as the group behind the sophisticated supply chain attack on SolarWinds Orion software disclosed in late 2020. The SUNBURST malware was inserted into SolarWinds Orion updates, enabling attackers to gain persistent, stealthy access to victim networks. This OSINT report appears to be a collection or analysis of publicly available intelligence related to UNC2452/SUNBURST, rather than a direct vulnerability or exploit itself. The data does not specify new technical details, affected versions, or direct exploit mechanisms but categorizes the information as related to payload delivery and external analysis. The severity is marked as high, reflecting the known impact of the SUNBURST campaign historically. However, no patches or direct mitigations are linked to this OSINT feed, and no active exploits are reported in the wild from this specific entry. The certainty is moderate (50%), indicating that the findings are not fully confirmed or may be partial. Overall, this entry serves as an intelligence update or aggregation rather than a new technical threat vector.
Potential Impact
The original SUNBURST compromise had severe impacts on organizations globally, including European entities, due to the widespread use of SolarWinds Orion software in government, critical infrastructure, and private sectors. The stealthy nature of the malware allowed attackers to exfiltrate sensitive data, conduct espionage, and maintain long-term access. For European organizations, the impact includes potential breaches of confidentiality, loss of intellectual property, disruption of operations, and reputational damage. Given the OSINT nature of this report, it primarily aids defenders in understanding threat actor tactics and infrastructure rather than indicating a new immediate threat. However, the ongoing intelligence about UNC2452 can help European organizations anticipate related or follow-on attacks leveraging similar techniques or infrastructure. The lack of new exploit information reduces immediate risk but underscores the importance of vigilance against supply chain compromises and advanced persistent threats (APTs).
Mitigation Recommendations
Since this report is OSINT related and does not describe a new vulnerability or exploit, mitigation focuses on leveraging the intelligence to enhance detection and response capabilities. European organizations should: 1) Ensure SolarWinds Orion products are updated to the latest patched versions released after the SUNBURST disclosure. 2) Employ threat hunting using indicators of compromise (IOCs) and TTPs associated with UNC2452, including network traffic analysis for known SUNBURST C2 domains and behaviors. 3) Implement enhanced monitoring of supply chain software updates and validate digital signatures. 4) Conduct thorough audits of privileged accounts and lateral movement detection. 5) Share intelligence within trusted communities to stay informed on emerging developments related to UNC2452. 6) Harden endpoint and network defenses to detect stealthy malware and anomalous activity. 7) Develop incident response plans specifically addressing supply chain compromise scenarios. These steps go beyond generic advice by focusing on intelligence-driven detection and supply chain security.
Affected Countries
United Kingdom, Germany, France, Netherlands, Belgium, Italy, Spain, Sweden, Norway, Finland
Indicators of Compromise
- hash: 1acf3108bf1e376c8848fbb25dc87424f2c2a39c
- hash: e257236206e99f5a5c62035c9c59c57206728b28
- hash: bcb5a4dcbc60d26a5f619518f2cfc1b4bb4e4387
- hash: 5e643654179e8b4cfe1d3c1906a90a4c8d611cea
- hash: ebe711516d0f5cd8126f4d53e375c90b7b95e8f2
- link: https://vxug.fakedoma.in/samples/Exotic/UNC2452/SolarWinds%20Breach/
- text: .text
- size-in-bytes: 1018368
- float: 5.5695446259584
- hash: 5a1c26db5b9b9a2d0a630e63ff83f0bf
- hash: 18ea74745f5c8992a95ae40bfe2158c8d7e34acf
- hash: 02811d870295f78bf9aa3c9f42ca11f2838171fe73e70dbbc158fae590161573
- hash: c0e04da710f18443018aeef4ab387903f93f95a42b700a3a88b3ea7c35ae3821850f1583494172f5650a69a9acf8f9d63d1fca22aac115f1fdc4ec8b78c5d7e6
- ssdeep: 12288:6JKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+BYvjenWHuhh9c0g8vkzK19QU:KEfDbO97P8TrK0YbenWH4c0g8vkzK19b
- text: .rsrc
- size-in-bytes: 1536
- float: 3.3927625723408
- hash: da27d86acfb9504441eebac21f66a5df
- hash: 939387cdbb29755bf192c2bfce2701c1a27354a6
- hash: 016bbefdcbda1e07eca63a07fabe2dad2b25a4b78cd0bc6564c6d0ad3a6b7523
- hash: 713dece3f4687ea6e4591a7e9e3975ce0bfae2dda5a742b29e78ee5088ae148992995373177a1d5583c6da4877c99e813ba440e386705c2bd7b1ea8c2058e498
- ssdeep: 24:YE66ZyxF4iPXOL1+N0MnaOL1hyYinXF4OL1F3YOL15PNMMDqMM:YrjleBw0MjBhyXBB9hB7MM2MM
- text: .reloc
- size-in-bytes: 512
- float: 1.9473387961876
- hash: a29f1db3dd779a4a629939ffeaa3835b
- hash: c306017f3277b148c4a8914a6c4e46abc1496c94
- hash: 6743e59441d06b5b27d6c2c9cc28ba3e4e81d8955aa0ecde9233cfac0b6e019b
- hash: 17a273facc124e6696eb6e1dc7c1c81c7dd478f2bff5b9160b6678dca0e460235b1f4a013e49f389a1d8d06bc0ca4471500219ee85e533a64afd2441f9bccef3
- ssdeep: 3:6/Pl:6/d
- text: dll
- text: 269460022
- datetime: 2020-05-11T21:32:40+00:00
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2020.2.5300.12432
- text: 000004b0
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2020.2.5300.12432
- text: SolarWinds Worldwide, LLC.
- text: Copyright © 1999-2020 SolarWinds Worldwide, LLC. All Rights Reserved.
- counter: 3
- file: ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6
- size-in-bytes: 1028072
- float: 5.5800537860468
- hash: 846e27a652a5e1bfbd0ddd38a16dc865
- hash: d130bd75645c2433f88ac03e73395fba172ef676
- hash: ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6
- hash: c26e275b4232be844f6c4062a4f42413099452085060ed4080b880b52800428cd32f69271c98977fa979a89355fbb3b485855ca3d51499bca12dfbf8c3168d2f
- malware-sample: ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6|846e27a652a5e1bfbd0ddd38a16dc865
- mime-type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
- ssdeep: 12288:5JKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+BYvjenWHuhh9c0g8vkzK19Q:vEfDbO97P8TrK0YbenWH4c0g8vkzK19
- text: .text
- size-in-bytes: 924672
- float: 5.6441844251496
- hash: cf450191b90401e1015aa2433d7d0b47
- hash: e812fddc3c622905954663d30b25fa8adcca6850
- hash: e29b19ea0c58095c3ab7a19374734bba58effb01498c3f748824fed32326cb06
- hash: 612f4238bbf10e162cf33b6ec9e69d975fb67a1f78f9a6f5436460fcd7664909ab2aaceaa4466eaafdde23b62e2dffe51a4e5addcfc028211c77981f0d6f9d13
- ssdeep: 24576:GdBfeHcrhCECR1R/zoi8SHoN0W8vB8O3IcL:qe8nK/zopSHoN0W8vB8u
- text: .rsrc
- size-in-bytes: 1536
- float: 3.3987008123389
- hash: 005f91999efb988bc401181d2cf103de
- hash: 3a6f37bdbd8f812efd0805a5e14f468da79832cc
- hash: 4497bf92f774c9d57a1ad1cf5842e82c94efe82adb78ff3a90a015376361b284
- hash: 3da3a9c6f0e53126d2c2723262dbfb08716c02af82157a952da7f2d66540fafabe8db2e2f7c8091ec68f4463feb070bb37ae1b54c91a1d0a07fdf98a5518192e
- ssdeep: 24:LXsfQMKyxF4iPXOL1XNN9aOL1hninXF4OL1F3YOL1sPNelvq:LXsnjleBHJBhmBB9hB86i
- text: .reloc
- size-in-bytes: 512
- float: 1.9473387961876
- hash: 32e87d188187fe9b9f6afd9de48a41d6
- hash: 2e10d4aa9df60691736123b143dc3e1dc677330a
- hash: ca16d1bd56e607403c1b0b5d74c6dc3b8366fa3d982146cc0ec2948099ecfbad
- hash: 8e56b8ec1f8828ac8eef7bb7758987aad8f09be39ae0873c2c1ccefa49b8416a48787488ce21c96159cfa536f881151a3372e1cba0dc40b59f338329287fc010
- ssdeep: 3:HlZn:r
- text: dll
- text: 269367810
- datetime: 2019-10-10T13:26:39+00:00
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2019.4.5200.8890
- text: 000004b0
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2019.4.5200.8890
- text: SolarWinds Worldwide, LLC.
- text: Copyright © 1999-2019 SolarWinds Worldwide, LLC. All Rights Reserved.
- counter: 3
- file: a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc
- size-in-bytes: 934232
- float: 5.6560901874991
- hash: e18a6a21eb44e77ca8d739a72209c370
- hash: 5e643654179e8b4cfe1d3c1906a90a4c8d611cea
- hash: a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc
- hash: 17b4de6158de054c02849bb728b9767208d3f07ef18d4dc41963a370d34e9dbcf7cc4b729726903f1a7afd4ef7e8c1d781c20a3049a2c160dede23614352f11c
- malware-sample: a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc|e18a6a21eb44e77ca8d739a72209c370
- mime-type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
- ssdeep: 24576:ldBfeHcrhCECR1R/zoi8SHoN0W8vB8O3Icu:5e8nK/zopSHoN0W8vB83
- text: .text
- size-in-bytes: 1018368
- float: 5.5694865540978
- hash: 26ec41a94ea4d2a3fbfebbe0a32cfa0b
- hash: c83bb058abe34b411897a5feea274a4926ec20da
- hash: 6127115190de534d0f57f23add63dbc8c414ed99789644c1fa7e932cdbb01519
- hash: b4b49fe5725fe8807331672049dd4804929da896e63181eb7022825331fa64ec0eb18dd33c112688e23062b77248adf307151a3bcf71bd1816f5f79640abdc2f
- ssdeep: 12288:6JKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+cYvjenWHuhh9c0g8vkzE19Wa:KEfDbO97P8TrKhYbenWH4c0g8vkzE19j
- text: .rsrc
- size-in-bytes: 1536
- float: 3.389713791853
- hash: 9bd1855b2d66ddb1fb9bfb0be0907ac2
- hash: d0b5359a9a5744d632dbd321ca3a00c1a3f547b9
- hash: 7871935602a9354b0d04469b185dd7f20ddd0d80f45dd7946d6315c7352b8d8c
- hash: 24b2c0c16a3e87a2469bf3315a59153f5ffb74518b50a1ee25cde89f81b919489dca38188f32ebe78b8d488dc30c291ebec665360240d926d297afba89942630
- ssdeep: 24:YA66ZyxF4iPXOL1+N0ZaaOL1hyYinXF4OL1F3YOL15PNMZkqMZ:YPjleBw0gBhyXBB9hB7MzM
- text: .reloc
- size-in-bytes: 512
- float: 1.9473387961876
- hash: a29f1db3dd779a4a629939ffeaa3835b
- hash: c306017f3277b148c4a8914a6c4e46abc1496c94
- hash: 6743e59441d06b5b27d6c2c9cc28ba3e4e81d8955aa0ecde9233cfac0b6e019b
- hash: 17a273facc124e6696eb6e1dc7c1c81c7dd478f2bff5b9160b6678dca0e460235b1f4a013e49f389a1d8d06bc0ca4471500219ee85e533a64afd2441f9bccef3
- ssdeep: 3:6/Pl:6/d
- text: dll
- text: 269460022
- datetime: 2020-04-21T14:53:33+00:00
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2020.2.5200.12394
- text: 000004b0
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2020.2.5200.12394
- text: SolarWinds Worldwide, LLC.
- text: Copyright © 1999-2020 SolarWinds Worldwide, LLC. All Rights Reserved.
- counter: 3
- file: 019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134
- size-in-bytes: 1028072
- float: 5.5799968662039
- hash: 2c4a910a1299cdae2a4e55988a2f102e
- hash: 2f1a5a7411d015d01aaee4535835400191645023
- hash: 019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134
- hash: 5cbfefe612a40c8872a0faf3db8d3835dc514fb3df159610095b47c595c6caa1ada79cce2b10fb99e648990c3f54f63344d1fa7025090bfcd4e2c55d7210a28d
- malware-sample: 019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134|2c4a910a1299cdae2a4e55988a2f102e
- mime-type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
- ssdeep: 12288:dJKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+cYvjenWHuhh9c0g8vkzE19Wv:rEfDbO97P8TrKhYbenWH4c0g8vkzE19e
- text: .text
- size-in-bytes: 1001472
- float: 5.5697311444704
- hash: c4a55257e26e3b07339fa125f5223a72
- hash: 6c2e6a1b9ebb7d0eedb9e11d8017ff6c795b9b98
- hash: 9e1e82ad740aba788850c5529e3eb84681b0a53b6c76ff5eadc6cb762823dba3
- hash: 131e0b4fff35499da6e33f099f8fe96de1a65deec9522becbc8e55d0470f42f8d58cc2f3678eb2a82667bdcd96ed0f587464917290904f989678788a497849db
- ssdeep: 12288:0x7m/z9aEBzvnvLtYAi6uLlYQ69BBpIvF1tjpH7BKi+0A8vca9owY:PaEBTvRBi6uL6dIvDtjpH9+0A8vca9oj
- text: .rsrc
- size-in-bytes: 1536
- float: 3.4018646666713
- hash: 7454e0d2a852d8d802490dbc6c07f42e
- hash: b54275dd4daaa9467f91955b5b4670c20dfc4e49
- hash: e63d0b1280cd09f3d9236c4a7e428a000f0f87c6a707dbe2a6b5df3ceb24b48d
- hash: d982e2edba71923c7f9c4fdff636995fb475ba4146ea66dcb28b2b24c0e7f81742b4109ee9900ae7f9442ded32f1412311766cd374d88abdff2da317f752708d
- ssdeep: 24:wpyQMKyxF4iPXOL1XNNP+aOL1hyYinXF4OL1F3YOL1sPN3Flvq3:wp2jleBHSBhyXBB9hB8Pi
- text: .reloc
- size-in-bytes: 512
- float: 1.9473387961876
- hash: 89642b60883c693211567f54fcde5631
- hash: 0161b4dc14ed849384714b7d48e4ce8e31cee22d
- hash: 7e9191e9c1bd9624a97b0147d173abe2556a3b319dc1e1805d6ca2abc49c054b
- hash: 32837f59e1063a10eff10e71f8ab2f78205122c136ac48bd1e73cb877b375da94c4f6553e84a7080c3a36b8af4461efad16ab251c2c777100b69fb44826aa3cf
- ssdeep: 3:L:L
- text: dll
- text: 269443494
- datetime: 2020-03-24T08:52:34+00:00
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2019.4.5200.9083
- text: 000004b0
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2019.4.5200.9083
- text: SolarWinds Worldwide, LLC.
- text: Copyright © 1999-2020 SolarWinds Worldwide, LLC. All Rights Reserved.
- counter: 3
- file: 32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77
- size-in-bytes: 1011032
- float: 5.5828269967379
- hash: b91ce2fa41029f6955bff20079468448
- hash: 76640508b1e7759e548771a5359eaed353bf1eec
- hash: 32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77
- hash: 6a81f082f36ccbda48070772c5a97e1d7de61ad77465e7befe8cbd97df40dcc5da09c461311708e3d57527e323484b05cfd3e72a3c70e106e47f44cc77584bd7
- malware-sample: 32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77|b91ce2fa41029f6955bff20079468448
- mime-type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
- ssdeep: 12288:Zx7m/z9aEBzvnvLtYAi6uLlYQ69BBpIvF1tjpH7BKi+0A8vca9owQ:6aEBTvRBi6uL6dIvDtjpH9+0A8vca9oD
- text: .text
- size-in-bytes: 5632
- float: 5.4919156876928
- hash: 2109d02a31c7032f2bcabdf436b6726e
- hash: 84d90343ae39a961e9e0f92127333b9cc9d62d33
- hash: f04e002613102c556260dc57c5accb5db70b427a9c2fdd6f51419ff53499f173
- hash: 3c343696c837d1efc28ae4a688b863c4dff41e3b80047cd2ec6c9d571a3f677f8c750a5dabc7530c56d04749e0972d4d13403f05d10635a69ac82707bc984f8d
- ssdeep: 96:DKQSUZZa5aE8ibv1c8M1UBDawAjNXe+U8w15Gl+5DDGTBNF82gx:vqRzbt0GBDawA5uT8wSlyDDGTBNFS
- text: .rsrc
- size-in-bytes: 1024
- float: 3.1419883961028
- hash: 27193464e3effc6950cde66a4ad4757a
- hash: 01d5d5696eadc1963ccbbf7ff2f79ba482ed17e1
- hash: a4c3bc5b8ba65bfff823212b5f2d76f618cbb12fd1e17db85ed1bbff35783336
- hash: 394e55d211fd73d6d5a5aaabeeb6f0330cd6b6fba40a07bcdd789976097875da6d130ba8308478a1991d0217f0b22b0159f07232e7119dc36367784b176ae1e7
- ssdeep: 12:Essi3ntuAHeswYAB19aUGiqMZAiN5Eryi1qD41hPvYnqqf1qD41hoPN5Dlq5J:lIfs1FuZhNu8+PWN8+oPNnqX
- text: .reloc
- size-in-bytes: 512
- float: 1.5849625007212
- hash: 6a8e92fdd78e813e24abd0a0932052b9
- hash: 76e3423312516772e053f5d1861163dd27e99a8c
- hash: f81e587fb1c7b55c7daeeee2bca68e619df3c815b316e439ef006fd91894aa09
- hash: e91dae684ce94faddd8a4b69d745524f15494f22a55b87d4ef1dd5fa3b78e017a911d55148819ca2736e4c500742f82584dbb6cb9aa3a0b61fadf91a56b0dc3c
- ssdeep: 3:n:n
- text: dll
- text: 268448958
- datetime: 2020-03-24T09:16:10+00:00
- file: App_Web_logoimagehandler.ashx.b6031896.dll
- file: App_Web_logoimagehandler.ashx.b6031896.dll
- text: 0.0.0.0
- text: 000004b0
- text: 0.0.0.0
- counter: 3
- file: c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71
- size-in-bytes: 7680
- float: 4.6224498216263
- hash: 56ceb6d0011d87b6e4d7023d7ef85676
- hash: 75af292f34789a1c782ea36c7127bf6106f595e8
- hash: c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71
- hash: f7eac6ab99fe45ca46417cdca36ba27560d5f8a2f37f378ba97636662595d55fa34f749716971aa96a862e37e0199eb6cb905636e6ab0123cfa089adba450629
- malware-sample: c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71|56ceb6d0011d87b6e4d7023d7ef85676
- mime-type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
- ssdeep: 192:8/SqRzbt0GBDawA5uT8wSlyDDGTBNFkQ:8/SyHKGBDax5uThDD6BNr
- hash: 3e329a4c9030b26ba152fb602a1d5893
- hash: ebe711516d0f5cd8126f4d53e375c90b7b95e8f2
- hash: d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af
- datetime: 2020-12-14T06:35:21+00:00
- link: https://www.virustotal.com/gui/file/d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af/detection/f-d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af-1607927721
- text: 0/70
- datetime: 2020-12-14T06:24:36+00:00
- link: https://www.virustotal.com/gui/file/019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134/detection/f-019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134-1607927076
- text: 4/69
- datetime: 2020-12-14T06:47:17+00:00
- link: https://www.virustotal.com/gui/file/c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71/detection/f-c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71-1607928437
- text: 2/69
- datetime: 2020-12-14T07:32:31+00:00
- link: https://www.virustotal.com/gui/file/32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77/detection/f-32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77-1607931151
- text: 5/69
- datetime: 2020-12-14T07:28:34+00:00
- link: https://www.virustotal.com/gui/file/ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6/detection/f-ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6-1607930914
- text: 6/70
OSINT - UNC2452 / SUNBURST @vxunderground OSINT related findings
Description
OSINT - UNC2452 / SUNBURST @vxunderground OSINT related findings
AI-Powered Analysis
Technical Analysis
The provided information relates to OSINT (Open Source Intelligence) findings concerning the threat actor UNC2452, also known as SUNBURST. UNC2452 is widely recognized as the group behind the sophisticated supply chain attack on SolarWinds Orion software disclosed in late 2020. The SUNBURST malware was inserted into SolarWinds Orion updates, enabling attackers to gain persistent, stealthy access to victim networks. This OSINT report appears to be a collection or analysis of publicly available intelligence related to UNC2452/SUNBURST, rather than a direct vulnerability or exploit itself. The data does not specify new technical details, affected versions, or direct exploit mechanisms but categorizes the information as related to payload delivery and external analysis. The severity is marked as high, reflecting the known impact of the SUNBURST campaign historically. However, no patches or direct mitigations are linked to this OSINT feed, and no active exploits are reported in the wild from this specific entry. The certainty is moderate (50%), indicating that the findings are not fully confirmed or may be partial. Overall, this entry serves as an intelligence update or aggregation rather than a new technical threat vector.
Potential Impact
The original SUNBURST compromise had severe impacts on organizations globally, including European entities, due to the widespread use of SolarWinds Orion software in government, critical infrastructure, and private sectors. The stealthy nature of the malware allowed attackers to exfiltrate sensitive data, conduct espionage, and maintain long-term access. For European organizations, the impact includes potential breaches of confidentiality, loss of intellectual property, disruption of operations, and reputational damage. Given the OSINT nature of this report, it primarily aids defenders in understanding threat actor tactics and infrastructure rather than indicating a new immediate threat. However, the ongoing intelligence about UNC2452 can help European organizations anticipate related or follow-on attacks leveraging similar techniques or infrastructure. The lack of new exploit information reduces immediate risk but underscores the importance of vigilance against supply chain compromises and advanced persistent threats (APTs).
Mitigation Recommendations
Since this report is OSINT related and does not describe a new vulnerability or exploit, mitigation focuses on leveraging the intelligence to enhance detection and response capabilities. European organizations should: 1) Ensure SolarWinds Orion products are updated to the latest patched versions released after the SUNBURST disclosure. 2) Employ threat hunting using indicators of compromise (IOCs) and TTPs associated with UNC2452, including network traffic analysis for known SUNBURST C2 domains and behaviors. 3) Implement enhanced monitoring of supply chain software updates and validate digital signatures. 4) Conduct thorough audits of privileged accounts and lateral movement detection. 5) Share intelligence within trusted communities to stay informed on emerging developments related to UNC2452. 6) Harden endpoint and network defenses to detect stealthy malware and anomalous activity. 7) Develop incident response plans specifically addressing supply chain compromise scenarios. These steps go beyond generic advice by focusing on intelligence-driven detection and supply chain security.
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Uuid
- f78232e7-0b7a-49f7-9e57-1482db2b6335
- Original Timestamp
- 1607931286
Indicators of Compromise
Hash
| Value | Description | Copy |
|---|---|---|
hash1acf3108bf1e376c8848fbb25dc87424f2c2a39c | — | |
hashe257236206e99f5a5c62035c9c59c57206728b28 | — | |
hashbcb5a4dcbc60d26a5f619518f2cfc1b4bb4e4387 | — | |
hash5e643654179e8b4cfe1d3c1906a90a4c8d611cea | — | |
hashebe711516d0f5cd8126f4d53e375c90b7b95e8f2 | — | |
hash5a1c26db5b9b9a2d0a630e63ff83f0bf | — | |
hash18ea74745f5c8992a95ae40bfe2158c8d7e34acf | — | |
hash02811d870295f78bf9aa3c9f42ca11f2838171fe73e70dbbc158fae590161573 | — | |
hashc0e04da710f18443018aeef4ab387903f93f95a42b700a3a88b3ea7c35ae3821850f1583494172f5650a69a9acf8f9d63d1fca22aac115f1fdc4ec8b78c5d7e6 | — | |
hashda27d86acfb9504441eebac21f66a5df | — | |
hash939387cdbb29755bf192c2bfce2701c1a27354a6 | — | |
hash016bbefdcbda1e07eca63a07fabe2dad2b25a4b78cd0bc6564c6d0ad3a6b7523 | — | |
hash713dece3f4687ea6e4591a7e9e3975ce0bfae2dda5a742b29e78ee5088ae148992995373177a1d5583c6da4877c99e813ba440e386705c2bd7b1ea8c2058e498 | — | |
hasha29f1db3dd779a4a629939ffeaa3835b | — | |
hashc306017f3277b148c4a8914a6c4e46abc1496c94 | — | |
hash6743e59441d06b5b27d6c2c9cc28ba3e4e81d8955aa0ecde9233cfac0b6e019b | — | |
hash17a273facc124e6696eb6e1dc7c1c81c7dd478f2bff5b9160b6678dca0e460235b1f4a013e49f389a1d8d06bc0ca4471500219ee85e533a64afd2441f9bccef3 | — | |
hash846e27a652a5e1bfbd0ddd38a16dc865 | — | |
hashd130bd75645c2433f88ac03e73395fba172ef676 | — | |
hashce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6 | — | |
hashc26e275b4232be844f6c4062a4f42413099452085060ed4080b880b52800428cd32f69271c98977fa979a89355fbb3b485855ca3d51499bca12dfbf8c3168d2f | — | |
hashcf450191b90401e1015aa2433d7d0b47 | — | |
hashe812fddc3c622905954663d30b25fa8adcca6850 | — | |
hashe29b19ea0c58095c3ab7a19374734bba58effb01498c3f748824fed32326cb06 | — | |
hash612f4238bbf10e162cf33b6ec9e69d975fb67a1f78f9a6f5436460fcd7664909ab2aaceaa4466eaafdde23b62e2dffe51a4e5addcfc028211c77981f0d6f9d13 | — | |
hash005f91999efb988bc401181d2cf103de | — | |
hash3a6f37bdbd8f812efd0805a5e14f468da79832cc | — | |
hash4497bf92f774c9d57a1ad1cf5842e82c94efe82adb78ff3a90a015376361b284 | — | |
hash3da3a9c6f0e53126d2c2723262dbfb08716c02af82157a952da7f2d66540fafabe8db2e2f7c8091ec68f4463feb070bb37ae1b54c91a1d0a07fdf98a5518192e | — | |
hash32e87d188187fe9b9f6afd9de48a41d6 | — | |
hash2e10d4aa9df60691736123b143dc3e1dc677330a | — | |
hashca16d1bd56e607403c1b0b5d74c6dc3b8366fa3d982146cc0ec2948099ecfbad | — | |
hash8e56b8ec1f8828ac8eef7bb7758987aad8f09be39ae0873c2c1ccefa49b8416a48787488ce21c96159cfa536f881151a3372e1cba0dc40b59f338329287fc010 | — | |
hashe18a6a21eb44e77ca8d739a72209c370 | — | |
hash5e643654179e8b4cfe1d3c1906a90a4c8d611cea | — | |
hasha25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc | — | |
hash17b4de6158de054c02849bb728b9767208d3f07ef18d4dc41963a370d34e9dbcf7cc4b729726903f1a7afd4ef7e8c1d781c20a3049a2c160dede23614352f11c | — | |
hash26ec41a94ea4d2a3fbfebbe0a32cfa0b | — | |
hashc83bb058abe34b411897a5feea274a4926ec20da | — | |
hash6127115190de534d0f57f23add63dbc8c414ed99789644c1fa7e932cdbb01519 | — | |
hashb4b49fe5725fe8807331672049dd4804929da896e63181eb7022825331fa64ec0eb18dd33c112688e23062b77248adf307151a3bcf71bd1816f5f79640abdc2f | — | |
hash9bd1855b2d66ddb1fb9bfb0be0907ac2 | — | |
hashd0b5359a9a5744d632dbd321ca3a00c1a3f547b9 | — | |
hash7871935602a9354b0d04469b185dd7f20ddd0d80f45dd7946d6315c7352b8d8c | — | |
hash24b2c0c16a3e87a2469bf3315a59153f5ffb74518b50a1ee25cde89f81b919489dca38188f32ebe78b8d488dc30c291ebec665360240d926d297afba89942630 | — | |
hasha29f1db3dd779a4a629939ffeaa3835b | — | |
hashc306017f3277b148c4a8914a6c4e46abc1496c94 | — | |
hash6743e59441d06b5b27d6c2c9cc28ba3e4e81d8955aa0ecde9233cfac0b6e019b | — | |
hash17a273facc124e6696eb6e1dc7c1c81c7dd478f2bff5b9160b6678dca0e460235b1f4a013e49f389a1d8d06bc0ca4471500219ee85e533a64afd2441f9bccef3 | — | |
hash2c4a910a1299cdae2a4e55988a2f102e | — | |
hash2f1a5a7411d015d01aaee4535835400191645023 | — | |
hash019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134 | — | |
hash5cbfefe612a40c8872a0faf3db8d3835dc514fb3df159610095b47c595c6caa1ada79cce2b10fb99e648990c3f54f63344d1fa7025090bfcd4e2c55d7210a28d | — | |
hashc4a55257e26e3b07339fa125f5223a72 | — | |
hash6c2e6a1b9ebb7d0eedb9e11d8017ff6c795b9b98 | — | |
hash9e1e82ad740aba788850c5529e3eb84681b0a53b6c76ff5eadc6cb762823dba3 | — | |
hash131e0b4fff35499da6e33f099f8fe96de1a65deec9522becbc8e55d0470f42f8d58cc2f3678eb2a82667bdcd96ed0f587464917290904f989678788a497849db | — | |
hash7454e0d2a852d8d802490dbc6c07f42e | — | |
hashb54275dd4daaa9467f91955b5b4670c20dfc4e49 | — | |
hashe63d0b1280cd09f3d9236c4a7e428a000f0f87c6a707dbe2a6b5df3ceb24b48d | — | |
hashd982e2edba71923c7f9c4fdff636995fb475ba4146ea66dcb28b2b24c0e7f81742b4109ee9900ae7f9442ded32f1412311766cd374d88abdff2da317f752708d | — | |
hash89642b60883c693211567f54fcde5631 | — | |
hash0161b4dc14ed849384714b7d48e4ce8e31cee22d | — | |
hash7e9191e9c1bd9624a97b0147d173abe2556a3b319dc1e1805d6ca2abc49c054b | — | |
hash32837f59e1063a10eff10e71f8ab2f78205122c136ac48bd1e73cb877b375da94c4f6553e84a7080c3a36b8af4461efad16ab251c2c777100b69fb44826aa3cf | — | |
hashb91ce2fa41029f6955bff20079468448 | — | |
hash76640508b1e7759e548771a5359eaed353bf1eec | — | |
hash32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77 | — | |
hash6a81f082f36ccbda48070772c5a97e1d7de61ad77465e7befe8cbd97df40dcc5da09c461311708e3d57527e323484b05cfd3e72a3c70e106e47f44cc77584bd7 | — | |
hash2109d02a31c7032f2bcabdf436b6726e | — | |
hash84d90343ae39a961e9e0f92127333b9cc9d62d33 | — | |
hashf04e002613102c556260dc57c5accb5db70b427a9c2fdd6f51419ff53499f173 | — | |
hash3c343696c837d1efc28ae4a688b863c4dff41e3b80047cd2ec6c9d571a3f677f8c750a5dabc7530c56d04749e0972d4d13403f05d10635a69ac82707bc984f8d | — | |
hash27193464e3effc6950cde66a4ad4757a | — | |
hash01d5d5696eadc1963ccbbf7ff2f79ba482ed17e1 | — | |
hasha4c3bc5b8ba65bfff823212b5f2d76f618cbb12fd1e17db85ed1bbff35783336 | — | |
hash394e55d211fd73d6d5a5aaabeeb6f0330cd6b6fba40a07bcdd789976097875da6d130ba8308478a1991d0217f0b22b0159f07232e7119dc36367784b176ae1e7 | — | |
hash6a8e92fdd78e813e24abd0a0932052b9 | — | |
hash76e3423312516772e053f5d1861163dd27e99a8c | — | |
hashf81e587fb1c7b55c7daeeee2bca68e619df3c815b316e439ef006fd91894aa09 | — | |
hashe91dae684ce94faddd8a4b69d745524f15494f22a55b87d4ef1dd5fa3b78e017a911d55148819ca2736e4c500742f82584dbb6cb9aa3a0b61fadf91a56b0dc3c | — | |
hash56ceb6d0011d87b6e4d7023d7ef85676 | — | |
hash75af292f34789a1c782ea36c7127bf6106f595e8 | — | |
hashc15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71 | — | |
hashf7eac6ab99fe45ca46417cdca36ba27560d5f8a2f37f378ba97636662595d55fa34f749716971aa96a862e37e0199eb6cb905636e6ab0123cfa089adba450629 | — | |
hash3e329a4c9030b26ba152fb602a1d5893 | — | |
hashebe711516d0f5cd8126f4d53e375c90b7b95e8f2 | — | |
hashd3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af | — |
Link
| Value | Description | Copy |
|---|---|---|
linkhttps://vxug.fakedoma.in/samples/Exotic/UNC2452/SolarWinds%20Breach/ | — | |
linkhttps://www.virustotal.com/gui/file/d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af/detection/f-d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af-1607927721 | — | |
linkhttps://www.virustotal.com/gui/file/019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134/detection/f-019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134-1607927076 | — | |
linkhttps://www.virustotal.com/gui/file/c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71/detection/f-c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71-1607928437 | — | |
linkhttps://www.virustotal.com/gui/file/32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77/detection/f-32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77-1607931151 | — | |
linkhttps://www.virustotal.com/gui/file/ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6/detection/f-ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6-1607930914 | — |
Text
| Value | Description | Copy |
|---|---|---|
text.text | — | |
text.rsrc | — | |
text.reloc | — | |
textdll | — | |
text269460022 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2020.2.5300.12432 | — | |
text000004b0 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2020.2.5300.12432 | — | |
textSolarWinds Worldwide, LLC. | — | |
textCopyright © 1999-2020 SolarWinds Worldwide, LLC. All Rights Reserved. | — | |
text.text | — | |
text.rsrc | — | |
text.reloc | — | |
textdll | — | |
text269367810 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2019.4.5200.8890 | — | |
text000004b0 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2019.4.5200.8890 | — | |
textSolarWinds Worldwide, LLC. | — | |
textCopyright © 1999-2019 SolarWinds Worldwide, LLC. All Rights Reserved. | — | |
text.text | — | |
text.rsrc | — | |
text.reloc | — | |
textdll | — | |
text269460022 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2020.2.5200.12394 | — | |
text000004b0 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2020.2.5200.12394 | — | |
textSolarWinds Worldwide, LLC. | — | |
textCopyright © 1999-2020 SolarWinds Worldwide, LLC. All Rights Reserved. | — | |
text.text | — | |
text.rsrc | — | |
text.reloc | — | |
textdll | — | |
text269443494 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2019.4.5200.9083 | — | |
text000004b0 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2019.4.5200.9083 | — | |
textSolarWinds Worldwide, LLC. | — | |
textCopyright © 1999-2020 SolarWinds Worldwide, LLC. All Rights Reserved. | — | |
text.text | — | |
text.rsrc | — | |
text.reloc | — | |
textdll | — | |
text268448958 | — | |
text0.0.0.0 | — | |
text000004b0 | — | |
text0.0.0.0 | — | |
text0/70 | — | |
text4/69 | — | |
text2/69 | — | |
text5/69 | — | |
text6/70 | — |
Size in-bytes
| Value | Description | Copy |
|---|---|---|
size-in-bytes1018368 | — | |
size-in-bytes1536 | — | |
size-in-bytes512 | — | |
size-in-bytes1028072 | — | |
size-in-bytes924672 | — | |
size-in-bytes1536 | — | |
size-in-bytes512 | — | |
size-in-bytes934232 | — | |
size-in-bytes1018368 | — | |
size-in-bytes1536 | — | |
size-in-bytes512 | — | |
size-in-bytes1028072 | — | |
size-in-bytes1001472 | — | |
size-in-bytes1536 | — | |
size-in-bytes512 | — | |
size-in-bytes1011032 | — | |
size-in-bytes5632 | — | |
size-in-bytes1024 | — | |
size-in-bytes512 | — | |
size-in-bytes7680 | — |
Float
| Value | Description | Copy |
|---|---|---|
float5.5695446259584 | — | |
float3.3927625723408 | — | |
float1.9473387961876 | — | |
float5.5800537860468 | — | |
float5.6441844251496 | — | |
float3.3987008123389 | — | |
float1.9473387961876 | — | |
float5.6560901874991 | — | |
float5.5694865540978 | — | |
float3.389713791853 | — | |
float1.9473387961876 | — | |
float5.5799968662039 | — | |
float5.5697311444704 | — | |
float3.4018646666713 | — | |
float1.9473387961876 | — | |
float5.5828269967379 | — | |
float5.4919156876928 | — | |
float3.1419883961028 | — | |
float1.5849625007212 | — | |
float4.6224498216263 | — |
Ssdeep
| Value | Description | Copy |
|---|---|---|
ssdeep12288:6JKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+BYvjenWHuhh9c0g8vkzK19QU:KEfDbO97P8TrK0YbenWH4c0g8vkzK19b | — | |
ssdeep24:YE66ZyxF4iPXOL1+N0MnaOL1hyYinXF4OL1F3YOL15PNMMDqMM:YrjleBw0MjBhyXBB9hB7MM2MM | — | |
ssdeep3:6/Pl:6/d | — | |
ssdeep12288:5JKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+BYvjenWHuhh9c0g8vkzK19Q:vEfDbO97P8TrK0YbenWH4c0g8vkzK19 | — | |
ssdeep24576:GdBfeHcrhCECR1R/zoi8SHoN0W8vB8O3IcL:qe8nK/zopSHoN0W8vB8u | — | |
ssdeep24:LXsfQMKyxF4iPXOL1XNN9aOL1hninXF4OL1F3YOL1sPNelvq:LXsnjleBHJBhmBB9hB86i | — | |
ssdeep3:HlZn:r | — | |
ssdeep24576:ldBfeHcrhCECR1R/zoi8SHoN0W8vB8O3Icu:5e8nK/zopSHoN0W8vB83 | — | |
ssdeep12288:6JKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+cYvjenWHuhh9c0g8vkzE19Wa:KEfDbO97P8TrKhYbenWH4c0g8vkzE19j | — | |
ssdeep24:YA66ZyxF4iPXOL1+N0ZaaOL1hyYinXF4OL1F3YOL15PNMZkqMZ:YPjleBw0gBhyXBB9hB7MzM | — | |
ssdeep3:6/Pl:6/d | — | |
ssdeep12288:dJKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+cYvjenWHuhh9c0g8vkzE19Wv:rEfDbO97P8TrKhYbenWH4c0g8vkzE19e | — | |
ssdeep12288:0x7m/z9aEBzvnvLtYAi6uLlYQ69BBpIvF1tjpH7BKi+0A8vca9owY:PaEBTvRBi6uL6dIvDtjpH9+0A8vca9oj | — | |
ssdeep24:wpyQMKyxF4iPXOL1XNNP+aOL1hyYinXF4OL1F3YOL1sPN3Flvq3:wp2jleBHSBhyXBB9hB8Pi | — | |
ssdeep3:L:L | — | |
ssdeep12288:Zx7m/z9aEBzvnvLtYAi6uLlYQ69BBpIvF1tjpH7BKi+0A8vca9owQ:6aEBTvRBi6uL6dIvDtjpH9+0A8vca9oD | — | |
ssdeep96:DKQSUZZa5aE8ibv1c8M1UBDawAjNXe+U8w15Gl+5DDGTBNF82gx:vqRzbt0GBDawA5uT8wSlyDDGTBNFS | — | |
ssdeep12:Essi3ntuAHeswYAB19aUGiqMZAiN5Eryi1qD41hPvYnqqf1qD41hoPN5Dlq5J:lIfs1FuZhNu8+PWN8+oPNnqX | — | |
ssdeep3:n:n | — | |
ssdeep192:8/SqRzbt0GBDawA5uT8wSlyDDGTBNFkQ:8/SyHKGBDax5uThDD6BNr | — |
Datetime
| Value | Description | Copy |
|---|---|---|
datetime2020-05-11T21:32:40+00:00 | — | |
datetime2019-10-10T13:26:39+00:00 | — | |
datetime2020-04-21T14:53:33+00:00 | — | |
datetime2020-03-24T08:52:34+00:00 | — | |
datetime2020-03-24T09:16:10+00:00 | — | |
datetime2020-12-14T06:35:21+00:00 | — | |
datetime2020-12-14T06:24:36+00:00 | — | |
datetime2020-12-14T06:47:17+00:00 | — | |
datetime2020-12-14T07:32:31+00:00 | — | |
datetime2020-12-14T07:28:34+00:00 | — |
File
| Value | Description | Copy |
|---|---|---|
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
filece77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6 | — | |
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
filea25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc | — | |
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
file019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134 | — | |
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
file32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77 | — | |
fileApp_Web_logoimagehandler.ashx.b6031896.dll | — | |
fileApp_Web_logoimagehandler.ashx.b6031896.dll | — | |
filec15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71 | — |
Counter
| Value | Description | Copy |
|---|---|---|
counter3 | — | |
counter3 | — | |
counter3 | — | |
counter3 | — | |
counter3 | — |
Malware sample
| Value | Description | Copy |
|---|---|---|
malware-samplece77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6|846e27a652a5e1bfbd0ddd38a16dc865 | — | |
malware-samplea25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc|e18a6a21eb44e77ca8d739a72209c370 | — | |
malware-sample019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134|2c4a910a1299cdae2a4e55988a2f102e | — | |
malware-sample32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77|b91ce2fa41029f6955bff20079468448 | — | |
malware-samplec15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71|56ceb6d0011d87b6e4d7023d7ef85676 | — |
Mime type
| Value | Description | Copy |
|---|---|---|
mime-typePE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows | — | |
mime-typePE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows | — | |
mime-typePE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows | — | |
mime-typePE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows | — | |
mime-typePE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows | — |
Threat ID: 68359c9e5d5f0974d01fb95e
Added to database: 5/27/2025, 11:06:06 AM
Last enriched: 7/5/2025, 10:27:37 PM
Last updated: 8/10/2025, 1:45:18 PM
Views: 10
Related Threats
Actions
Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.