sunburst | 2024-04-24_c142f1ced276487f2a995d580d145fde_andromeda_aspxspy_bisonal_china-chopper_cobalt-strike_suckerpunch_sunburst_wannacry_webshell-shell

General

Target

2024-04-24_c142f1ced276487f2a995d580d145fde_andromeda_aspxspy_bisonal_china-chopper_cobalt-strike_suckerpunch_sunburst_wannacry_webshell-shell
Size

4.9MB
MD5

c142f1ced276487f2a995d580d145fde
SHA1

32b10994db98aee817e557eff6537ae1ceb9004b
SHA256

bdd3f9dc758b9ee2b902744296375495593b4ccb97de07fc318724a8518bc0c3
SHA512

f0d2e4cb3f70a001619bba0d4d520189c44b7943eef24a34b573f2ab0263e3cfe0e3de56726c4ca256dc3e48b147583d2607886c7aa885dab5eb6f71a3b97265
SSDEEP

24576:Nzd9gfpaixnVyYvIK9SG26i42qoZyR7aPIa0faixnVyYoyy4hIagmrUGmbnUx5UM:Nzd9aHcYi42qoZGaP0HIRmObnUx5EA

Score

10^/10

backdoor sunburst

Detected SUNBURST backdoor 1 IoCs

SUNBURST is a backdoor for the SolarWinds Orion platform with extensive capabilities.

resource	yara_rule
sample	family_sunburst

Detects executables containing bas64 encoded gzip files 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-24_c142f1ced276487f2a995d580d145fde_andromeda_aspxspy_bisonal_china-chopper_cobalt-strike_suckerpunch_sunburst_wannacry_webshell-shell