Rewterz Threat Alert – Sunburst aka Solorigate Malware – Active IOCs

Severity

High

Analysis Summary

The Sunburst malware, also known as Solorigate or SolarWinds malware, is a highly sophisticated and advanced persistent threat (APT) that was discovered in December 2020. The malware was used in a supply chain attack that targeted the SolarWinds Orion network management software.

The malware is believed to have been developed by a state-sponsored group operating out of Russia, and it is one of the most significant cyber threats to have been discovered in recent years. The malware is distributed via a software update to the SolarWinds Orion platform, which is used by thousands of organizations worldwide. Once it gains access to a target network, it establishes a foothold, and then uses a variety of techniques to move laterally across the network, collecting data and exfiltrating it to the attackers’ command-and-control server.

The malware uses a number of sophisticated techniques to evade detection, including the use of legitimate tools and software, the use of multiple layers of encryption, and the use of a custom-built, encrypted protocol for communication with the command-and-control server. The malware is also able to persist on the network even after the initial compromise has been detected and cleaned up.

The impact of the Sunburst malware is still being assessed, but it is believed that the attackers were able to gain access to a large number of organizations, including government agencies and private companies, and that they were able to steal sensitive data and intellectual property. The malware is still active, and it is likely that new variants and attacks will be discovered in the future.

It is important to note that this is a summary of the analysis of the Sunburst malware, it is highly sophisticated and continues to evolve, so it is important to stay informed and follow the best practices and guidance provided by cybersecurity experts.

Impact

• Unauthorized access
• Information theft

Indicators of Compromise

MD5

• 02af7cec58b9a5da1c542b5a32151ba1
• 846e27a652a5e1bfbd0ddd38a16dc865
• b91ce2fa41029f6955bff20079468448
• 2c4a910a1299cdae2a4e55988a2f102e

SHA-256

• d0d626deb3f9484e649294a8dfa814c5568f846d5aa02d4cdad5d041a29d5600
• ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6
• 32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77
• 019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134

SHA-1

• 1b476f58ca366b54f34d714ffce3fd73cc30db1a
• d130bd75645c2433f88ac03e73395fba172ef676
• 76640508b1e7759e548771a5359eaed353bf1eec
• 2f1a5a7411d015d01aaee4535835400191645023

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.