SolarWinds Sunburst backdoor mutex

583da945-62af-10e8-4902-a8f205c72b2e
SolarWinds Sunburst backdoor mutex

583da945-62af-10e8-4902-a8f205c72b2e 1790-01-23 19:53:03⋮ 7077· 1ba5 SolarWinds Sunburst backdoor mutex

Version	None
Variant	reserved for NCS compatibility
urn	urn:uuid:583da945-62af-10e8-4902-a8f205c72b2e
Hexdump	583da94562af10e84902a8f205c72b2e
Bytes	X=⌐Eb»␐ΦI␂¿≥␅╟+.
Clock ID	2306
Clock ID (hex)	0x902
Timestamp, RFC	1790-01-23 19:53:03
Timestamp, MS	1808-04-12 19:53:03
Timestamp, UNIX	2177-04-11 19:53:03
Raw hex timestamp	0xe862af583da945
Raw timestamp	65410699836107077
Sub-millisecond timestamp	7077
MAC Address	a8f205c72b2e
is_local bit	False
is_multicast bit	False
MAC Manufacturer	None
UUIDv1	timestamp + clock_id + version (1) + node ID (MAC)
MAC Date	None

UUID registration form :

SolarWinds.Orion.Core.BusinessLayer.dll.
config

Once the threshold is met, the sample creates the named pipe 583da945-62af-10e8-4902-a8f205c72b2e to act as a guard that only one instance is running before reading SolarWinds.Orion.Core.BusinessLayer.dll.config from disk and retrieving the XML field appSettings.

https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html

1 fireeye

SolarWinds sunburst backdoor app id

 4505 // b'583da945-62af-10e8-4902-a8f205c72b2e\n'   // M7UwTkm0NDHVNTNKTNM1NEi10DWxNDDSTbRIMzIwTTY3SjJKBQA=
 4506     private static readonly string appId = ZipHelper.Unzip("M7UwTkm0NDHVNTNKTNM1NEi10DWxNDDSTbRIMzIwTTY3SjJKBQA=");

0 author

583da945-62af-10e8-4902-a8f205c72b2eSolarWinds Sunburst backdoor mutex

583da945-62af-10e8-4902-a8f205c72b2e
SolarWinds Sunburst backdoor mutex