OSINT - UNC2452 / SUNBURST @vxunderground OSINT related findings
OSINT - UNC2452 / SUNBURST @vxunderground OSINT related findings
AI Analysis
Technical Summary
The threat identified as UNC2452, also known as SUNBURST, is associated with a sophisticated supply chain attack that was publicly disclosed in late 2020. This threat involves a botnet infrastructure used to deliver malicious payloads through compromised software updates, specifically targeting SolarWinds Orion products. The attack leveraged the trusted software update mechanism to distribute a backdoor, enabling threat actors to gain persistent, stealthy access to victim networks. Although the provided data is categorized under OSINT (Open Source Intelligence) findings and does not specify affected product versions or direct exploits, the association with UNC2452/SUNBURST indicates a high-impact threat involving advanced persistent threat (APT) tactics. The threat's technical details show a high threat level but limited direct analysis data, and no patches or known exploits in the wild are listed in this dataset. The botnet nature of the threat suggests it is used for command and control (C2) communications and payload delivery, facilitating lateral movement and data exfiltration within targeted environments. The perpetual lifetime tag implies ongoing relevance and potential for continued exploitation or analysis. The certainty level of 50% indicates moderate confidence in the OSINT findings, suggesting that while the threat is credible, some aspects may still be under investigation or not fully confirmed. Overall, this threat represents a complex, stealthy, and highly impactful supply chain compromise with significant implications for organizations relying on affected software components.
Potential Impact
For European organizations, the impact of the UNC2452/SUNBURST threat is substantial. Given the widespread use of SolarWinds Orion products across various sectors including government, critical infrastructure, telecommunications, and large enterprises, a successful compromise can lead to unauthorized access to sensitive data, disruption of services, and long-term espionage. The stealthy nature of the backdoor allows attackers to remain undetected for extended periods, increasing the risk of extensive data exfiltration and potential sabotage. European entities involved in strategic industries such as energy, finance, and public administration are particularly vulnerable due to the critical nature of their operations and the potential geopolitical ramifications. The supply chain attack vector also undermines trust in software providers, complicating incident response and remediation efforts. Additionally, the botnet infrastructure can be leveraged to orchestrate further attacks, amplifying the threat's reach and persistence within European networks.
Mitigation Recommendations
Given the absence of direct patches and the sophisticated nature of the threat, mitigation should focus on a multi-layered approach: 1) Conduct comprehensive network and endpoint monitoring to detect unusual outbound communications indicative of C2 traffic associated with the botnet. 2) Implement strict network segmentation to limit lateral movement if a compromise occurs. 3) Employ threat hunting techniques using indicators of compromise (IoCs) related to UNC2452/SUNBURST, leveraging updated threat intelligence feeds from trusted sources such as CIRCL and national cybersecurity centers. 4) Validate the integrity of software updates and binaries, using cryptographic verification and anomaly detection to identify tampered components. 5) Enhance logging and audit capabilities to facilitate rapid detection and forensic analysis. 6) Engage in coordinated vulnerability disclosure and information sharing with industry peers and governmental bodies to stay informed on emerging developments. 7) Prepare incident response plans specifically addressing supply chain compromises, including containment, eradication, and recovery procedures. 8) Restrict administrative privileges and enforce multi-factor authentication to reduce the risk of credential abuse. These measures go beyond generic advice by focusing on detection and containment strategies tailored to supply chain and stealthy botnet threats.
Affected Countries
Germany, France, United Kingdom, Netherlands, Belgium, Italy, Spain, Poland, Sweden, Finland
Indicators of Compromise
- hash: 1acf3108bf1e376c8848fbb25dc87424f2c2a39c
- hash: e257236206e99f5a5c62035c9c59c57206728b28
- hash: bcb5a4dcbc60d26a5f619518f2cfc1b4bb4e4387
- hash: 5e643654179e8b4cfe1d3c1906a90a4c8d611cea
- hash: ebe711516d0f5cd8126f4d53e375c90b7b95e8f2
- link: https://vxug.fakedoma.in/samples/Exotic/UNC2452/SolarWinds%20Breach/
- text: .text
- size-in-bytes: 1018368
- float: 5.5695446259584
- hash: 5a1c26db5b9b9a2d0a630e63ff83f0bf
- hash: 18ea74745f5c8992a95ae40bfe2158c8d7e34acf
- hash: 02811d870295f78bf9aa3c9f42ca11f2838171fe73e70dbbc158fae590161573
- hash: c0e04da710f18443018aeef4ab387903f93f95a42b700a3a88b3ea7c35ae3821850f1583494172f5650a69a9acf8f9d63d1fca22aac115f1fdc4ec8b78c5d7e6
- ssdeep: 12288:6JKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+BYvjenWHuhh9c0g8vkzK19QU:KEfDbO97P8TrK0YbenWH4c0g8vkzK19b
- text: .rsrc
- size-in-bytes: 1536
- float: 3.3927625723408
- hash: da27d86acfb9504441eebac21f66a5df
- hash: 939387cdbb29755bf192c2bfce2701c1a27354a6
- hash: 016bbefdcbda1e07eca63a07fabe2dad2b25a4b78cd0bc6564c6d0ad3a6b7523
- hash: 713dece3f4687ea6e4591a7e9e3975ce0bfae2dda5a742b29e78ee5088ae148992995373177a1d5583c6da4877c99e813ba440e386705c2bd7b1ea8c2058e498
- ssdeep: 24:YE66ZyxF4iPXOL1+N0MnaOL1hyYinXF4OL1F3YOL15PNMMDqMM:YrjleBw0MjBhyXBB9hB7MM2MM
- text: .reloc
- size-in-bytes: 512
- float: 1.9473387961876
- hash: a29f1db3dd779a4a629939ffeaa3835b
- hash: c306017f3277b148c4a8914a6c4e46abc1496c94
- hash: 6743e59441d06b5b27d6c2c9cc28ba3e4e81d8955aa0ecde9233cfac0b6e019b
- hash: 17a273facc124e6696eb6e1dc7c1c81c7dd478f2bff5b9160b6678dca0e460235b1f4a013e49f389a1d8d06bc0ca4471500219ee85e533a64afd2441f9bccef3
- ssdeep: 3:6/Pl:6/d
- text: dll
- text: 269460022
- datetime: 2020-05-11T21:32:40+00:00
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2020.2.5300.12432
- text: 000004b0
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2020.2.5300.12432
- text: SolarWinds Worldwide, LLC.
- text: Copyright © 1999-2020 SolarWinds Worldwide, LLC. All Rights Reserved.
- counter: 3
- file: ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6
- size-in-bytes: 1028072
- float: 5.5800537860468
- hash: 846e27a652a5e1bfbd0ddd38a16dc865
- hash: d130bd75645c2433f88ac03e73395fba172ef676
- hash: ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6
- hash: c26e275b4232be844f6c4062a4f42413099452085060ed4080b880b52800428cd32f69271c98977fa979a89355fbb3b485855ca3d51499bca12dfbf8c3168d2f
- malware-sample: ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6|846e27a652a5e1bfbd0ddd38a16dc865
- mime-type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
- ssdeep: 12288:5JKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+BYvjenWHuhh9c0g8vkzK19Q:vEfDbO97P8TrK0YbenWH4c0g8vkzK19
- text: .text
- size-in-bytes: 924672
- float: 5.6441844251496
- hash: cf450191b90401e1015aa2433d7d0b47
- hash: e812fddc3c622905954663d30b25fa8adcca6850
- hash: e29b19ea0c58095c3ab7a19374734bba58effb01498c3f748824fed32326cb06
- hash: 612f4238bbf10e162cf33b6ec9e69d975fb67a1f78f9a6f5436460fcd7664909ab2aaceaa4466eaafdde23b62e2dffe51a4e5addcfc028211c77981f0d6f9d13
- ssdeep: 24576:GdBfeHcrhCECR1R/zoi8SHoN0W8vB8O3IcL:qe8nK/zopSHoN0W8vB8u
- text: .rsrc
- size-in-bytes: 1536
- float: 3.3987008123389
- hash: 005f91999efb988bc401181d2cf103de
- hash: 3a6f37bdbd8f812efd0805a5e14f468da79832cc
- hash: 4497bf92f774c9d57a1ad1cf5842e82c94efe82adb78ff3a90a015376361b284
- hash: 3da3a9c6f0e53126d2c2723262dbfb08716c02af82157a952da7f2d66540fafabe8db2e2f7c8091ec68f4463feb070bb37ae1b54c91a1d0a07fdf98a5518192e
- ssdeep: 24:LXsfQMKyxF4iPXOL1XNN9aOL1hninXF4OL1F3YOL1sPNelvq:LXsnjleBHJBhmBB9hB86i
- text: .reloc
- size-in-bytes: 512
- float: 1.9473387961876
- hash: 32e87d188187fe9b9f6afd9de48a41d6
- hash: 2e10d4aa9df60691736123b143dc3e1dc677330a
- hash: ca16d1bd56e607403c1b0b5d74c6dc3b8366fa3d982146cc0ec2948099ecfbad
- hash: 8e56b8ec1f8828ac8eef7bb7758987aad8f09be39ae0873c2c1ccefa49b8416a48787488ce21c96159cfa536f881151a3372e1cba0dc40b59f338329287fc010
- ssdeep: 3:HlZn:r
- text: dll
- text: 269367810
- datetime: 2019-10-10T13:26:39+00:00
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2019.4.5200.8890
- text: 000004b0
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2019.4.5200.8890
- text: SolarWinds Worldwide, LLC.
- text: Copyright © 1999-2019 SolarWinds Worldwide, LLC. All Rights Reserved.
- counter: 3
- file: a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc
- size-in-bytes: 934232
- float: 5.6560901874991
- hash: e18a6a21eb44e77ca8d739a72209c370
- hash: 5e643654179e8b4cfe1d3c1906a90a4c8d611cea
- hash: a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc
- hash: 17b4de6158de054c02849bb728b9767208d3f07ef18d4dc41963a370d34e9dbcf7cc4b729726903f1a7afd4ef7e8c1d781c20a3049a2c160dede23614352f11c
- malware-sample: a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc|e18a6a21eb44e77ca8d739a72209c370
- mime-type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
- ssdeep: 24576:ldBfeHcrhCECR1R/zoi8SHoN0W8vB8O3Icu:5e8nK/zopSHoN0W8vB83
- text: .text
- size-in-bytes: 1018368
- float: 5.5694865540978
- hash: 26ec41a94ea4d2a3fbfebbe0a32cfa0b
- hash: c83bb058abe34b411897a5feea274a4926ec20da
- hash: 6127115190de534d0f57f23add63dbc8c414ed99789644c1fa7e932cdbb01519
- hash: b4b49fe5725fe8807331672049dd4804929da896e63181eb7022825331fa64ec0eb18dd33c112688e23062b77248adf307151a3bcf71bd1816f5f79640abdc2f
- ssdeep: 12288:6JKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+cYvjenWHuhh9c0g8vkzE19Wa:KEfDbO97P8TrKhYbenWH4c0g8vkzE19j
- text: .rsrc
- size-in-bytes: 1536
- float: 3.389713791853
- hash: 9bd1855b2d66ddb1fb9bfb0be0907ac2
- hash: d0b5359a9a5744d632dbd321ca3a00c1a3f547b9
- hash: 7871935602a9354b0d04469b185dd7f20ddd0d80f45dd7946d6315c7352b8d8c
- hash: 24b2c0c16a3e87a2469bf3315a59153f5ffb74518b50a1ee25cde89f81b919489dca38188f32ebe78b8d488dc30c291ebec665360240d926d297afba89942630
- ssdeep: 24:YA66ZyxF4iPXOL1+N0ZaaOL1hyYinXF4OL1F3YOL15PNMZkqMZ:YPjleBw0gBhyXBB9hB7MzM
- text: .reloc
- size-in-bytes: 512
- float: 1.9473387961876
- hash: a29f1db3dd779a4a629939ffeaa3835b
- hash: c306017f3277b148c4a8914a6c4e46abc1496c94
- hash: 6743e59441d06b5b27d6c2c9cc28ba3e4e81d8955aa0ecde9233cfac0b6e019b
- hash: 17a273facc124e6696eb6e1dc7c1c81c7dd478f2bff5b9160b6678dca0e460235b1f4a013e49f389a1d8d06bc0ca4471500219ee85e533a64afd2441f9bccef3
- ssdeep: 3:6/Pl:6/d
- text: dll
- text: 269460022
- datetime: 2020-04-21T14:53:33+00:00
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2020.2.5200.12394
- text: 000004b0
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2020.2.5200.12394
- text: SolarWinds Worldwide, LLC.
- text: Copyright © 1999-2020 SolarWinds Worldwide, LLC. All Rights Reserved.
- counter: 3
- file: 019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134
- size-in-bytes: 1028072
- float: 5.5799968662039
- hash: 2c4a910a1299cdae2a4e55988a2f102e
- hash: 2f1a5a7411d015d01aaee4535835400191645023
- hash: 019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134
- hash: 5cbfefe612a40c8872a0faf3db8d3835dc514fb3df159610095b47c595c6caa1ada79cce2b10fb99e648990c3f54f63344d1fa7025090bfcd4e2c55d7210a28d
- malware-sample: 019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134|2c4a910a1299cdae2a4e55988a2f102e
- mime-type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
- ssdeep: 12288:dJKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+cYvjenWHuhh9c0g8vkzE19Wv:rEfDbO97P8TrKhYbenWH4c0g8vkzE19e
- text: .text
- size-in-bytes: 1001472
- float: 5.5697311444704
- hash: c4a55257e26e3b07339fa125f5223a72
- hash: 6c2e6a1b9ebb7d0eedb9e11d8017ff6c795b9b98
- hash: 9e1e82ad740aba788850c5529e3eb84681b0a53b6c76ff5eadc6cb762823dba3
- hash: 131e0b4fff35499da6e33f099f8fe96de1a65deec9522becbc8e55d0470f42f8d58cc2f3678eb2a82667bdcd96ed0f587464917290904f989678788a497849db
- ssdeep: 12288:0x7m/z9aEBzvnvLtYAi6uLlYQ69BBpIvF1tjpH7BKi+0A8vca9owY:PaEBTvRBi6uL6dIvDtjpH9+0A8vca9oj
- text: .rsrc
- size-in-bytes: 1536
- float: 3.4018646666713
- hash: 7454e0d2a852d8d802490dbc6c07f42e
- hash: b54275dd4daaa9467f91955b5b4670c20dfc4e49
- hash: e63d0b1280cd09f3d9236c4a7e428a000f0f87c6a707dbe2a6b5df3ceb24b48d
- hash: d982e2edba71923c7f9c4fdff636995fb475ba4146ea66dcb28b2b24c0e7f81742b4109ee9900ae7f9442ded32f1412311766cd374d88abdff2da317f752708d
- ssdeep: 24:wpyQMKyxF4iPXOL1XNNP+aOL1hyYinXF4OL1F3YOL1sPN3Flvq3:wp2jleBHSBhyXBB9hB8Pi
- text: .reloc
- size-in-bytes: 512
- float: 1.9473387961876
- hash: 89642b60883c693211567f54fcde5631
- hash: 0161b4dc14ed849384714b7d48e4ce8e31cee22d
- hash: 7e9191e9c1bd9624a97b0147d173abe2556a3b319dc1e1805d6ca2abc49c054b
- hash: 32837f59e1063a10eff10e71f8ab2f78205122c136ac48bd1e73cb877b375da94c4f6553e84a7080c3a36b8af4461efad16ab251c2c777100b69fb44826aa3cf
- ssdeep: 3:L:L
- text: dll
- text: 269443494
- datetime: 2020-03-24T08:52:34+00:00
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- file: SolarWinds.Orion.Core.BusinessLayer.dll
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2019.4.5200.9083
- text: 000004b0
- text: SolarWinds.Orion.Core.BusinessLayer
- text: 2019.4.5200.9083
- text: SolarWinds Worldwide, LLC.
- text: Copyright © 1999-2020 SolarWinds Worldwide, LLC. All Rights Reserved.
- counter: 3
- file: 32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77
- size-in-bytes: 1011032
- float: 5.5828269967379
- hash: b91ce2fa41029f6955bff20079468448
- hash: 76640508b1e7759e548771a5359eaed353bf1eec
- hash: 32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77
- hash: 6a81f082f36ccbda48070772c5a97e1d7de61ad77465e7befe8cbd97df40dcc5da09c461311708e3d57527e323484b05cfd3e72a3c70e106e47f44cc77584bd7
- malware-sample: 32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77|b91ce2fa41029f6955bff20079468448
- mime-type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
- ssdeep: 12288:Zx7m/z9aEBzvnvLtYAi6uLlYQ69BBpIvF1tjpH7BKi+0A8vca9owQ:6aEBTvRBi6uL6dIvDtjpH9+0A8vca9oD
- text: .text
- size-in-bytes: 5632
- float: 5.4919156876928
- hash: 2109d02a31c7032f2bcabdf436b6726e
- hash: 84d90343ae39a961e9e0f92127333b9cc9d62d33
- hash: f04e002613102c556260dc57c5accb5db70b427a9c2fdd6f51419ff53499f173
- hash: 3c343696c837d1efc28ae4a688b863c4dff41e3b80047cd2ec6c9d571a3f677f8c750a5dabc7530c56d04749e0972d4d13403f05d10635a69ac82707bc984f8d
- ssdeep: 96:DKQSUZZa5aE8ibv1c8M1UBDawAjNXe+U8w15Gl+5DDGTBNF82gx:vqRzbt0GBDawA5uT8wSlyDDGTBNFS
- text: .rsrc
- size-in-bytes: 1024
- float: 3.1419883961028
- hash: 27193464e3effc6950cde66a4ad4757a
- hash: 01d5d5696eadc1963ccbbf7ff2f79ba482ed17e1
- hash: a4c3bc5b8ba65bfff823212b5f2d76f618cbb12fd1e17db85ed1bbff35783336
- hash: 394e55d211fd73d6d5a5aaabeeb6f0330cd6b6fba40a07bcdd789976097875da6d130ba8308478a1991d0217f0b22b0159f07232e7119dc36367784b176ae1e7
- ssdeep: 12:Essi3ntuAHeswYAB19aUGiqMZAiN5Eryi1qD41hPvYnqqf1qD41hoPN5Dlq5J:lIfs1FuZhNu8+PWN8+oPNnqX
- text: .reloc
- size-in-bytes: 512
- float: 1.5849625007212
- hash: 6a8e92fdd78e813e24abd0a0932052b9
- hash: 76e3423312516772e053f5d1861163dd27e99a8c
- hash: f81e587fb1c7b55c7daeeee2bca68e619df3c815b316e439ef006fd91894aa09
- hash: e91dae684ce94faddd8a4b69d745524f15494f22a55b87d4ef1dd5fa3b78e017a911d55148819ca2736e4c500742f82584dbb6cb9aa3a0b61fadf91a56b0dc3c
- ssdeep: 3:n:n
- text: dll
- text: 268448958
- datetime: 2020-03-24T09:16:10+00:00
- file: App_Web_logoimagehandler.ashx.b6031896.dll
- file: App_Web_logoimagehandler.ashx.b6031896.dll
- text: 0.0.0.0
- text: 000004b0
- text: 0.0.0.0
- counter: 3
- file: c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71
- size-in-bytes: 7680
- float: 4.6224498216263
- hash: 56ceb6d0011d87b6e4d7023d7ef85676
- hash: 75af292f34789a1c782ea36c7127bf6106f595e8
- hash: c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71
- hash: f7eac6ab99fe45ca46417cdca36ba27560d5f8a2f37f378ba97636662595d55fa34f749716971aa96a862e37e0199eb6cb905636e6ab0123cfa089adba450629
- malware-sample: c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71|56ceb6d0011d87b6e4d7023d7ef85676
- mime-type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
- ssdeep: 192:8/SqRzbt0GBDawA5uT8wSlyDDGTBNFkQ:8/SyHKGBDax5uThDD6BNr
- hash: 3e329a4c9030b26ba152fb602a1d5893
- hash: ebe711516d0f5cd8126f4d53e375c90b7b95e8f2
- hash: d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af
- datetime: 2020-12-14T06:35:21+00:00
- link: https://www.virustotal.com/gui/file/d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af/detection/f-d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af-1607927721
- text: 0/70
- datetime: 2020-12-14T06:24:36+00:00
- link: https://www.virustotal.com/gui/file/019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134/detection/f-019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134-1607927076
- text: 4/69
- datetime: 2020-12-14T06:47:17+00:00
- link: https://www.virustotal.com/gui/file/c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71/detection/f-c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71-1607928437
- text: 2/69
- datetime: 2020-12-14T07:32:31+00:00
- link: https://www.virustotal.com/gui/file/32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77/detection/f-32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77-1607931151
- text: 5/69
- datetime: 2020-12-14T07:28:34+00:00
- link: https://www.virustotal.com/gui/file/ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6/detection/f-ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6-1607930914
- text: 6/70
OSINT - UNC2452 / SUNBURST @vxunderground OSINT related findings
Description
OSINT - UNC2452 / SUNBURST @vxunderground OSINT related findings
AI-Powered Analysis
Technical Analysis
The threat identified as UNC2452, also known as SUNBURST, is associated with a sophisticated supply chain attack that was publicly disclosed in late 2020. This threat involves a botnet infrastructure used to deliver malicious payloads through compromised software updates, specifically targeting SolarWinds Orion products. The attack leveraged the trusted software update mechanism to distribute a backdoor, enabling threat actors to gain persistent, stealthy access to victim networks. Although the provided data is categorized under OSINT (Open Source Intelligence) findings and does not specify affected product versions or direct exploits, the association with UNC2452/SUNBURST indicates a high-impact threat involving advanced persistent threat (APT) tactics. The threat's technical details show a high threat level but limited direct analysis data, and no patches or known exploits in the wild are listed in this dataset. The botnet nature of the threat suggests it is used for command and control (C2) communications and payload delivery, facilitating lateral movement and data exfiltration within targeted environments. The perpetual lifetime tag implies ongoing relevance and potential for continued exploitation or analysis. The certainty level of 50% indicates moderate confidence in the OSINT findings, suggesting that while the threat is credible, some aspects may still be under investigation or not fully confirmed. Overall, this threat represents a complex, stealthy, and highly impactful supply chain compromise with significant implications for organizations relying on affected software components.
Potential Impact
For European organizations, the impact of the UNC2452/SUNBURST threat is substantial. Given the widespread use of SolarWinds Orion products across various sectors including government, critical infrastructure, telecommunications, and large enterprises, a successful compromise can lead to unauthorized access to sensitive data, disruption of services, and long-term espionage. The stealthy nature of the backdoor allows attackers to remain undetected for extended periods, increasing the risk of extensive data exfiltration and potential sabotage. European entities involved in strategic industries such as energy, finance, and public administration are particularly vulnerable due to the critical nature of their operations and the potential geopolitical ramifications. The supply chain attack vector also undermines trust in software providers, complicating incident response and remediation efforts. Additionally, the botnet infrastructure can be leveraged to orchestrate further attacks, amplifying the threat's reach and persistence within European networks.
Mitigation Recommendations
Given the absence of direct patches and the sophisticated nature of the threat, mitigation should focus on a multi-layered approach: 1) Conduct comprehensive network and endpoint monitoring to detect unusual outbound communications indicative of C2 traffic associated with the botnet. 2) Implement strict network segmentation to limit lateral movement if a compromise occurs. 3) Employ threat hunting techniques using indicators of compromise (IoCs) related to UNC2452/SUNBURST, leveraging updated threat intelligence feeds from trusted sources such as CIRCL and national cybersecurity centers. 4) Validate the integrity of software updates and binaries, using cryptographic verification and anomaly detection to identify tampered components. 5) Enhance logging and audit capabilities to facilitate rapid detection and forensic analysis. 6) Engage in coordinated vulnerability disclosure and information sharing with industry peers and governmental bodies to stay informed on emerging developments. 7) Prepare incident response plans specifically addressing supply chain compromises, including containment, eradication, and recovery procedures. 8) Restrict administrative privileges and enforce multi-factor authentication to reduce the risk of credential abuse. These measures go beyond generic advice by focusing on detection and containment strategies tailored to supply chain and stealthy botnet threats.
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Threat Level
- 1
- Analysis
- 0
- Uuid
- f78232e7-0b7a-49f7-9e57-1482db2b6335
- Original Timestamp
- 1607931286
Indicators of Compromise
Hash
| Value | Description | Copy |
|---|---|---|
hash1acf3108bf1e376c8848fbb25dc87424f2c2a39c | — | |
hashe257236206e99f5a5c62035c9c59c57206728b28 | — | |
hashbcb5a4dcbc60d26a5f619518f2cfc1b4bb4e4387 | — | |
hash5e643654179e8b4cfe1d3c1906a90a4c8d611cea | — | |
hashebe711516d0f5cd8126f4d53e375c90b7b95e8f2 | — | |
hash5a1c26db5b9b9a2d0a630e63ff83f0bf | — | |
hash18ea74745f5c8992a95ae40bfe2158c8d7e34acf | — | |
hash02811d870295f78bf9aa3c9f42ca11f2838171fe73e70dbbc158fae590161573 | — | |
hashc0e04da710f18443018aeef4ab387903f93f95a42b700a3a88b3ea7c35ae3821850f1583494172f5650a69a9acf8f9d63d1fca22aac115f1fdc4ec8b78c5d7e6 | — | |
hashda27d86acfb9504441eebac21f66a5df | — | |
hash939387cdbb29755bf192c2bfce2701c1a27354a6 | — | |
hash016bbefdcbda1e07eca63a07fabe2dad2b25a4b78cd0bc6564c6d0ad3a6b7523 | — | |
hash713dece3f4687ea6e4591a7e9e3975ce0bfae2dda5a742b29e78ee5088ae148992995373177a1d5583c6da4877c99e813ba440e386705c2bd7b1ea8c2058e498 | — | |
hasha29f1db3dd779a4a629939ffeaa3835b | — | |
hashc306017f3277b148c4a8914a6c4e46abc1496c94 | — | |
hash6743e59441d06b5b27d6c2c9cc28ba3e4e81d8955aa0ecde9233cfac0b6e019b | — | |
hash17a273facc124e6696eb6e1dc7c1c81c7dd478f2bff5b9160b6678dca0e460235b1f4a013e49f389a1d8d06bc0ca4471500219ee85e533a64afd2441f9bccef3 | — | |
hash846e27a652a5e1bfbd0ddd38a16dc865 | — | |
hashd130bd75645c2433f88ac03e73395fba172ef676 | — | |
hashce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6 | — | |
hashc26e275b4232be844f6c4062a4f42413099452085060ed4080b880b52800428cd32f69271c98977fa979a89355fbb3b485855ca3d51499bca12dfbf8c3168d2f | — | |
hashcf450191b90401e1015aa2433d7d0b47 | — | |
hashe812fddc3c622905954663d30b25fa8adcca6850 | — | |
hashe29b19ea0c58095c3ab7a19374734bba58effb01498c3f748824fed32326cb06 | — | |
hash612f4238bbf10e162cf33b6ec9e69d975fb67a1f78f9a6f5436460fcd7664909ab2aaceaa4466eaafdde23b62e2dffe51a4e5addcfc028211c77981f0d6f9d13 | — | |
hash005f91999efb988bc401181d2cf103de | — | |
hash3a6f37bdbd8f812efd0805a5e14f468da79832cc | — | |
hash4497bf92f774c9d57a1ad1cf5842e82c94efe82adb78ff3a90a015376361b284 | — | |
hash3da3a9c6f0e53126d2c2723262dbfb08716c02af82157a952da7f2d66540fafabe8db2e2f7c8091ec68f4463feb070bb37ae1b54c91a1d0a07fdf98a5518192e | — | |
hash32e87d188187fe9b9f6afd9de48a41d6 | — | |
hash2e10d4aa9df60691736123b143dc3e1dc677330a | — | |
hashca16d1bd56e607403c1b0b5d74c6dc3b8366fa3d982146cc0ec2948099ecfbad | — | |
hash8e56b8ec1f8828ac8eef7bb7758987aad8f09be39ae0873c2c1ccefa49b8416a48787488ce21c96159cfa536f881151a3372e1cba0dc40b59f338329287fc010 | — | |
hashe18a6a21eb44e77ca8d739a72209c370 | — | |
hash5e643654179e8b4cfe1d3c1906a90a4c8d611cea | — | |
hasha25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc | — | |
hash17b4de6158de054c02849bb728b9767208d3f07ef18d4dc41963a370d34e9dbcf7cc4b729726903f1a7afd4ef7e8c1d781c20a3049a2c160dede23614352f11c | — | |
hash26ec41a94ea4d2a3fbfebbe0a32cfa0b | — | |
hashc83bb058abe34b411897a5feea274a4926ec20da | — | |
hash6127115190de534d0f57f23add63dbc8c414ed99789644c1fa7e932cdbb01519 | — | |
hashb4b49fe5725fe8807331672049dd4804929da896e63181eb7022825331fa64ec0eb18dd33c112688e23062b77248adf307151a3bcf71bd1816f5f79640abdc2f | — | |
hash9bd1855b2d66ddb1fb9bfb0be0907ac2 | — | |
hashd0b5359a9a5744d632dbd321ca3a00c1a3f547b9 | — | |
hash7871935602a9354b0d04469b185dd7f20ddd0d80f45dd7946d6315c7352b8d8c | — | |
hash24b2c0c16a3e87a2469bf3315a59153f5ffb74518b50a1ee25cde89f81b919489dca38188f32ebe78b8d488dc30c291ebec665360240d926d297afba89942630 | — | |
hasha29f1db3dd779a4a629939ffeaa3835b | — | |
hashc306017f3277b148c4a8914a6c4e46abc1496c94 | — | |
hash6743e59441d06b5b27d6c2c9cc28ba3e4e81d8955aa0ecde9233cfac0b6e019b | — | |
hash17a273facc124e6696eb6e1dc7c1c81c7dd478f2bff5b9160b6678dca0e460235b1f4a013e49f389a1d8d06bc0ca4471500219ee85e533a64afd2441f9bccef3 | — | |
hash2c4a910a1299cdae2a4e55988a2f102e | — | |
hash2f1a5a7411d015d01aaee4535835400191645023 | — | |
hash019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134 | — | |
hash5cbfefe612a40c8872a0faf3db8d3835dc514fb3df159610095b47c595c6caa1ada79cce2b10fb99e648990c3f54f63344d1fa7025090bfcd4e2c55d7210a28d | — | |
hashc4a55257e26e3b07339fa125f5223a72 | — | |
hash6c2e6a1b9ebb7d0eedb9e11d8017ff6c795b9b98 | — | |
hash9e1e82ad740aba788850c5529e3eb84681b0a53b6c76ff5eadc6cb762823dba3 | — | |
hash131e0b4fff35499da6e33f099f8fe96de1a65deec9522becbc8e55d0470f42f8d58cc2f3678eb2a82667bdcd96ed0f587464917290904f989678788a497849db | — | |
hash7454e0d2a852d8d802490dbc6c07f42e | — | |
hashb54275dd4daaa9467f91955b5b4670c20dfc4e49 | — | |
hashe63d0b1280cd09f3d9236c4a7e428a000f0f87c6a707dbe2a6b5df3ceb24b48d | — | |
hashd982e2edba71923c7f9c4fdff636995fb475ba4146ea66dcb28b2b24c0e7f81742b4109ee9900ae7f9442ded32f1412311766cd374d88abdff2da317f752708d | — | |
hash89642b60883c693211567f54fcde5631 | — | |
hash0161b4dc14ed849384714b7d48e4ce8e31cee22d | — | |
hash7e9191e9c1bd9624a97b0147d173abe2556a3b319dc1e1805d6ca2abc49c054b | — | |
hash32837f59e1063a10eff10e71f8ab2f78205122c136ac48bd1e73cb877b375da94c4f6553e84a7080c3a36b8af4461efad16ab251c2c777100b69fb44826aa3cf | — | |
hashb91ce2fa41029f6955bff20079468448 | — | |
hash76640508b1e7759e548771a5359eaed353bf1eec | — | |
hash32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77 | — | |
hash6a81f082f36ccbda48070772c5a97e1d7de61ad77465e7befe8cbd97df40dcc5da09c461311708e3d57527e323484b05cfd3e72a3c70e106e47f44cc77584bd7 | — | |
hash2109d02a31c7032f2bcabdf436b6726e | — | |
hash84d90343ae39a961e9e0f92127333b9cc9d62d33 | — | |
hashf04e002613102c556260dc57c5accb5db70b427a9c2fdd6f51419ff53499f173 | — | |
hash3c343696c837d1efc28ae4a688b863c4dff41e3b80047cd2ec6c9d571a3f677f8c750a5dabc7530c56d04749e0972d4d13403f05d10635a69ac82707bc984f8d | — | |
hash27193464e3effc6950cde66a4ad4757a | — | |
hash01d5d5696eadc1963ccbbf7ff2f79ba482ed17e1 | — | |
hasha4c3bc5b8ba65bfff823212b5f2d76f618cbb12fd1e17db85ed1bbff35783336 | — | |
hash394e55d211fd73d6d5a5aaabeeb6f0330cd6b6fba40a07bcdd789976097875da6d130ba8308478a1991d0217f0b22b0159f07232e7119dc36367784b176ae1e7 | — | |
hash6a8e92fdd78e813e24abd0a0932052b9 | — | |
hash76e3423312516772e053f5d1861163dd27e99a8c | — | |
hashf81e587fb1c7b55c7daeeee2bca68e619df3c815b316e439ef006fd91894aa09 | — | |
hashe91dae684ce94faddd8a4b69d745524f15494f22a55b87d4ef1dd5fa3b78e017a911d55148819ca2736e4c500742f82584dbb6cb9aa3a0b61fadf91a56b0dc3c | — | |
hash56ceb6d0011d87b6e4d7023d7ef85676 | — | |
hash75af292f34789a1c782ea36c7127bf6106f595e8 | — | |
hashc15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71 | — | |
hashf7eac6ab99fe45ca46417cdca36ba27560d5f8a2f37f378ba97636662595d55fa34f749716971aa96a862e37e0199eb6cb905636e6ab0123cfa089adba450629 | — | |
hash3e329a4c9030b26ba152fb602a1d5893 | — | |
hashebe711516d0f5cd8126f4d53e375c90b7b95e8f2 | — | |
hashd3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af | — |
Link
| Value | Description | Copy |
|---|---|---|
linkhttps://vxug.fakedoma.in/samples/Exotic/UNC2452/SolarWinds%20Breach/ | — | |
linkhttps://www.virustotal.com/gui/file/d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af/detection/f-d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af-1607927721 | — | |
linkhttps://www.virustotal.com/gui/file/019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134/detection/f-019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134-1607927076 | — | |
linkhttps://www.virustotal.com/gui/file/c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71/detection/f-c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71-1607928437 | — | |
linkhttps://www.virustotal.com/gui/file/32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77/detection/f-32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77-1607931151 | — | |
linkhttps://www.virustotal.com/gui/file/ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6/detection/f-ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6-1607930914 | — |
Text
| Value | Description | Copy |
|---|---|---|
text.text | — | |
text.rsrc | — | |
text.reloc | — | |
textdll | — | |
text269460022 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2020.2.5300.12432 | — | |
text000004b0 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2020.2.5300.12432 | — | |
textSolarWinds Worldwide, LLC. | — | |
textCopyright © 1999-2020 SolarWinds Worldwide, LLC. All Rights Reserved. | — | |
text.text | — | |
text.rsrc | — | |
text.reloc | — | |
textdll | — | |
text269367810 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2019.4.5200.8890 | — | |
text000004b0 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2019.4.5200.8890 | — | |
textSolarWinds Worldwide, LLC. | — | |
textCopyright © 1999-2019 SolarWinds Worldwide, LLC. All Rights Reserved. | — | |
text.text | — | |
text.rsrc | — | |
text.reloc | — | |
textdll | — | |
text269460022 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2020.2.5200.12394 | — | |
text000004b0 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2020.2.5200.12394 | — | |
textSolarWinds Worldwide, LLC. | — | |
textCopyright © 1999-2020 SolarWinds Worldwide, LLC. All Rights Reserved. | — | |
text.text | — | |
text.rsrc | — | |
text.reloc | — | |
textdll | — | |
text269443494 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2019.4.5200.9083 | — | |
text000004b0 | — | |
textSolarWinds.Orion.Core.BusinessLayer | — | |
text2019.4.5200.9083 | — | |
textSolarWinds Worldwide, LLC. | — | |
textCopyright © 1999-2020 SolarWinds Worldwide, LLC. All Rights Reserved. | — | |
text.text | — | |
text.rsrc | — | |
text.reloc | — | |
textdll | — | |
text268448958 | — | |
text0.0.0.0 | — | |
text000004b0 | — | |
text0.0.0.0 | — | |
text0/70 | — | |
text4/69 | — | |
text2/69 | — | |
text5/69 | — | |
text6/70 | — |
Size in-bytes
| Value | Description | Copy |
|---|---|---|
size-in-bytes1018368 | — | |
size-in-bytes1536 | — | |
size-in-bytes512 | — | |
size-in-bytes1028072 | — | |
size-in-bytes924672 | — | |
size-in-bytes1536 | — | |
size-in-bytes512 | — | |
size-in-bytes934232 | — | |
size-in-bytes1018368 | — | |
size-in-bytes1536 | — | |
size-in-bytes512 | — | |
size-in-bytes1028072 | — | |
size-in-bytes1001472 | — | |
size-in-bytes1536 | — | |
size-in-bytes512 | — | |
size-in-bytes1011032 | — | |
size-in-bytes5632 | — | |
size-in-bytes1024 | — | |
size-in-bytes512 | — | |
size-in-bytes7680 | — |
Float
| Value | Description | Copy |
|---|---|---|
float5.5695446259584 | — | |
float3.3927625723408 | — | |
float1.9473387961876 | — | |
float5.5800537860468 | — | |
float5.6441844251496 | — | |
float3.3987008123389 | — | |
float1.9473387961876 | — | |
float5.6560901874991 | — | |
float5.5694865540978 | — | |
float3.389713791853 | — | |
float1.9473387961876 | — | |
float5.5799968662039 | — | |
float5.5697311444704 | — | |
float3.4018646666713 | — | |
float1.9473387961876 | — | |
float5.5828269967379 | — | |
float5.4919156876928 | — | |
float3.1419883961028 | — | |
float1.5849625007212 | — | |
float4.6224498216263 | — |
Ssdeep
| Value | Description | Copy |
|---|---|---|
ssdeep12288:6JKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+BYvjenWHuhh9c0g8vkzK19QU:KEfDbO97P8TrK0YbenWH4c0g8vkzK19b | — | |
ssdeep24:YE66ZyxF4iPXOL1+N0MnaOL1hyYinXF4OL1F3YOL15PNMMDqMM:YrjleBw0MjBhyXBB9hB7MM2MM | — | |
ssdeep3:6/Pl:6/d | — | |
ssdeep12288:5JKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+BYvjenWHuhh9c0g8vkzK19Q:vEfDbO97P8TrK0YbenWH4c0g8vkzK19 | — | |
ssdeep24576:GdBfeHcrhCECR1R/zoi8SHoN0W8vB8O3IcL:qe8nK/zopSHoN0W8vB8u | — | |
ssdeep24:LXsfQMKyxF4iPXOL1XNN9aOL1hninXF4OL1F3YOL1sPNelvq:LXsnjleBHJBhmBB9hB86i | — | |
ssdeep3:HlZn:r | — | |
ssdeep24576:ldBfeHcrhCECR1R/zoi8SHoN0W8vB8O3Icu:5e8nK/zopSHoN0W8vB83 | — | |
ssdeep12288:6JKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+cYvjenWHuhh9c0g8vkzE19Wa:KEfDbO97P8TrKhYbenWH4c0g8vkzE19j | — | |
ssdeep24:YA66ZyxF4iPXOL1+N0ZaaOL1hyYinXF4OL1F3YOL15PNMZkqMZ:YPjleBw0gBhyXBB9hB7MzM | — | |
ssdeep3:6/Pl:6/d | — | |
ssdeep12288:dJKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+cYvjenWHuhh9c0g8vkzE19Wv:rEfDbO97P8TrKhYbenWH4c0g8vkzE19e | — | |
ssdeep12288:0x7m/z9aEBzvnvLtYAi6uLlYQ69BBpIvF1tjpH7BKi+0A8vca9owY:PaEBTvRBi6uL6dIvDtjpH9+0A8vca9oj | — | |
ssdeep24:wpyQMKyxF4iPXOL1XNNP+aOL1hyYinXF4OL1F3YOL1sPN3Flvq3:wp2jleBHSBhyXBB9hB8Pi | — | |
ssdeep3:L:L | — | |
ssdeep12288:Zx7m/z9aEBzvnvLtYAi6uLlYQ69BBpIvF1tjpH7BKi+0A8vca9owQ:6aEBTvRBi6uL6dIvDtjpH9+0A8vca9oD | — | |
ssdeep96:DKQSUZZa5aE8ibv1c8M1UBDawAjNXe+U8w15Gl+5DDGTBNF82gx:vqRzbt0GBDawA5uT8wSlyDDGTBNFS | — | |
ssdeep12:Essi3ntuAHeswYAB19aUGiqMZAiN5Eryi1qD41hPvYnqqf1qD41hoPN5Dlq5J:lIfs1FuZhNu8+PWN8+oPNnqX | — | |
ssdeep3:n:n | — | |
ssdeep192:8/SqRzbt0GBDawA5uT8wSlyDDGTBNFkQ:8/SyHKGBDax5uThDD6BNr | — |
Datetime
| Value | Description | Copy |
|---|---|---|
datetime2020-05-11T21:32:40+00:00 | — | |
datetime2019-10-10T13:26:39+00:00 | — | |
datetime2020-04-21T14:53:33+00:00 | — | |
datetime2020-03-24T08:52:34+00:00 | — | |
datetime2020-03-24T09:16:10+00:00 | — | |
datetime2020-12-14T06:35:21+00:00 | — | |
datetime2020-12-14T06:24:36+00:00 | — | |
datetime2020-12-14T06:47:17+00:00 | — | |
datetime2020-12-14T07:32:31+00:00 | — | |
datetime2020-12-14T07:28:34+00:00 | — |
File
| Value | Description | Copy |
|---|---|---|
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
filece77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6 | — | |
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
filea25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc | — | |
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
file019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134 | — | |
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
fileSolarWinds.Orion.Core.BusinessLayer.dll | — | |
file32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77 | — | |
fileApp_Web_logoimagehandler.ashx.b6031896.dll | — | |
fileApp_Web_logoimagehandler.ashx.b6031896.dll | — | |
filec15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71 | — |
Counter
| Value | Description | Copy |
|---|---|---|
counter3 | — | |
counter3 | — | |
counter3 | — | |
counter3 | — | |
counter3 | — |
Malware sample
| Value | Description | Copy |
|---|---|---|
malware-samplece77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6|846e27a652a5e1bfbd0ddd38a16dc865 | — | |
malware-samplea25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc|e18a6a21eb44e77ca8d739a72209c370 | — | |
malware-sample019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134|2c4a910a1299cdae2a4e55988a2f102e | — | |
malware-sample32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77|b91ce2fa41029f6955bff20079468448 | — | |
malware-samplec15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71|56ceb6d0011d87b6e4d7023d7ef85676 | — |
Mime type
| Value | Description | Copy |
|---|---|---|
mime-typePE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows | — | |
mime-typePE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows | — | |
mime-typePE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows | — | |
mime-typePE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows | — | |
mime-typePE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows | — |
Threat ID: 682acdbebbaf20d303f0de39
Added to database: 5/19/2025, 6:20:46 AM
Last enriched: 6/18/2025, 7:35:06 AM
Last updated: 7/28/2025, 2:56:29 AM
Views: 7
Related Threats
Actions
Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.