SolarWinds.Orion.Core.BusinessLayer.dll

Classification: Malicious

SolarWinds.Orion.Core.BusinessLayer.dll is a trojan (application/x-dosexec, 1004.0 KB). Flagged by 64% of antivirus engines (75 detections).

Detection summary

  • 75 antivirus detections (64% detection ratio)
  • 0 IDS alerts
  • 2 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: SUNBURST (S0559)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic.Malware Abuse.ch 2020-12-27 05:32:18 2020-12-27 05:32:18 malicious-activity
SUNBURST Abuse.ch 2020-12-27 05:32:18 2020-12-27 05:32:18 malicious-activity S0559 SUNBURST
Trojan.Sunburst Hybrid-Analysis 2020-12-22 21:45:05 2020-12-22 21:45:05

Sample information

Filenames
file, SolarWinds.Orion.Core.BusinessLayer.dll
File type
application/x-dosexec
Size
1028072 bytes
MD5
d5aad0d248c237360cf39c054b654d69
SHA-1
b485953ed77caefe81bff0d9b349a33c5cea4cde
SHA-256
abe22cf0d78836c3ea072daeaf4c5eeaf9c29b6feb597741651979fc8fbd2417
First indexed
2020-12-22 21:45:05
Last updated
2026-08-15 00:11:55

Antivirus detections

EngineDetection
MicroWorld-eScanTrojan.Sunburst.F
CAT-QuickHealBackdoor.MSIL
McAfeeTrojan-Sunburst!D5AAD0D248C2
CylanceUnsafe
CrowdStrikewin/malicious_confidence_100% (W)
BitDefenderTrojan.Sunburst.F
K7GWTrojan ( 00574b2b1 )
K7AntiVirusTrojan ( 00574b2b1 )
CyrenW32/MSIL_SunBurst.A.gen!Eldorado
SymantecBackdoor.Sunburst!gen1
Paloaltogeneric.ml
ClamAVWin.Countermeasure.Sunburst-9809152-0
KasperskyHEUR:Backdoor.MSIL.SunBurst.gen
AlibabaBackdoor:MSIL/SunBurst.031cf3c6
RisingBackdoor.SunBurst/APT#APT29!1.D029 (CLASSIC)
Ad-AwareTrojan.Sunburst.F
EmsisoftTrojan.Win32.Sunburst (A)
F-SecureTrojan.TR/Redcap.ykbgm
DrWebBackDoor.SiggenNET.14
McAfee-GW-EditionTrojan-Sunburst!D5AAD0D248C2
FireEyeTrojan.Sunburst.F
SophosMal/Sunburst-A
SentinelOneStatic AI - Malicious PE
JiangminBackdoor.MSIL.eatn
WebrootW32.Trojan.Sunburst
AviraTR/Redcap.ykbgm
MAXmalware (ai score=100)
MicrosoftTrojan:MSIL/Solorigate.BR!dha
ArcabitTrojan.Sunburst.F
ViRobotBackdoor.Win32.S.SunBurst.1028072.A
ZoneAlarmHEUR:Backdoor.MSIL.SunBurst.gen
GDataTrojan.Sunburst.F
CynetMalicious (score: 85)
AhnLab-V3Backdoor/Win32.SunBurst.R357806
ALYacTrojan.MSIL.SunBurst
TACHYONBackdoor/W32.DN-SunBurst.1028072
MalwarebytesBackdoor.Sunburst
PandaTrj/Solorigate.A
ESET-NOD32a variant of MSIL/SunBurst.A
TrendMicro-HouseCallBackdoor.MSIL.SUNBURST.A
IkarusTrojan.MSIL.Sunburst
FortinetW32/Agent.A!tr.bdr
AVGMSIL:SunBurst-C [Bd]
AvastMSIL:SunBurst-C [Bd]
Antiy-AVLTrojan[APT]/Win32.UNC2452
AviraBDS/SunBurst.C
BkavW32.Malware.330BFF73
CAT-QuickHealBackdoor.Sunburst.S17554866
CTXdll.trojan.sunburst
ESET-NOD32MSIL/SunBurst.A trojan
Elasticmalicious (high confidence)
F-SecureTrojan:W32/Sunburst.F
FortinetW32/Sunburst.A!tr
GoogleDetected
K7AntiVirusUnwanted-Program ( 700000201 )
K7GWUnwanted-Program ( 700000201 )
KingsoftMSIL.Backdoor.SunBurst.gen
LionicTrojan.MSIL.SunBurst.trD4
MalwarebytesMalware.AI.607298688
McAfeeDti!ABE22CF0D788
MicrosoftTrojan:MSIL/Solorigate!atmn
NANO-AntivirusTrojan.Win32.SunBurst.iepafx
RisingBackdoor.[APT29]SunBurst!1.D029 (CLASSIC)
SkyhighTrojan-Sunburst!D5AAD0D248C2
SophosMal/Generic-S
TencentMalware.Win32.Gencirc.13bbe3d4
TrellixENSTrojan-Sunburst!D5AAD0D248C2
TrendMicroBackdoor.MSIL.SUNBURST.A
VBA32TScope.Trojan.MSIL
VIPRETrojan.Sunburst.F
VaristW32/MSIL_SunBurst.A.gen!Eldorado
VirITTrojan.Win32.GenusT.FFDS
XcitiumMalware@#3i9fk7gbjkt1v
alibabacloudBackdoor:MSIL/SunBurst.A
huorongBackdoor/MSIL.SunBurst.a

Process list

NameCommand line
<Ignored Process>
regsvr32.exe/s "C:\file.dll"