SolarWinds.Orion.Core.BusinessLayer.dll

Classification: Malicious

SolarWinds.Orion.Core.BusinessLayer.dll is a malicious file sample (application/x-dosexec, 984.3 KB). Linked to Sunburst malware.

Detection summary

  • 0 antivirus detections (17% detection ratio)
  • 0 IDS alerts
  • 3 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: SUNBURST (S0559)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
SUNBURST Abuse.ch 2020-12-27 05:43:07 2020-12-27 05:43:07 malicious-activity S0559 SUNBURST
Generic.Malware Abuse.ch 2020-12-27 05:43:07 2020-12-27 05:43:07 malicious-activity
Trojan-Sunburst Hybrid-Analysis 2020-12-17 15:30:19 2020-12-17 15:30:19

Sample information

Filenames
SolarWinds.Orion.Core.BusinessLayer.dll, tmp41vnkda3
File type
application/x-dosexec
Size
1007896 bytes
MD5
7159f22f067d438ed6ba5859ed7b3743
SHA-1
0d1439389ab8f97e4f2f633b65830f79d649e497
SHA-256
db9e63337dacf0c0f1baa06145fd5f1007002c63124f99180f520ac11d551420
First indexed
2020-12-17 15:30:19
Last updated
2026-10-09 01:07:03

Process list

NameCommand line
<Ignored Process>
regsvr32.exe/s "C:\tmp41vnkda3.dll"
DismHost.exe{94794BD3-DD6D-406A-93CF-53A81CDA95D1}