4 ms·
https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/ https://www.crowdstrike.com/blog/sunspot-malware-technical-a... is the key link with more t
by HALtheWise 6y ago
https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/ https://www.crowdstrike.com/blog/sunspot-malware-technical-a... is the key link with more technical analysis for those interested, including source code of the implant.
"If the decryption of the parameters (target file path and replacement source code) is successful and if the MD5 checks pass, SUNSPOT proceeds with the replacement of the source file content. The original source file is copied with a .bk extension (e.g., InventoryManager.bk), to back up the original content. The backdoored source is written to the same filename, but with a .tmp extension (e.g., InventoryManager.tmp), before being moved using MoveFileEx to the original filename (InventoryManager.cs). After these steps, the source file backdoored with SUNBURST will then be compiled as part of the standard process."
- woliveirajr 6y agoThis, combined with comments from other threads, makes me think that SolarWinds wasn't the real target. They were just means to some specific high-value ends. When low-value companies were using it, the remote control would even remove the backdoor to avoid some accidental discovery. How, and how much, were the real targets affected?
- jaywalk 6y agoSolarWinds was absolutely not the real target. The malware wouldn't even execute if the machine it was installed on was joined to a domain containing the string "solarwinds".