SUNBURST SolarWinds Malware - Tools, Tactics and Methods to get you started with Reverse Engineering

An analysis of the SUNBURST SolarWinds malware using dnSpy to decompile and examine its .NET code, hashing, and encoding techniques.

Here we take a look inside so of the most complex, elegant, well-crafted malware I've seen, known as SUNBURST and responsible for the global SolarWinds compromise. This code is a malicious DLL, loaded by the parent platform and blends in exceptionally well to the whole code-ecosystem. We start by using DNSpy to decompile the .NET code, giving us access to the source code and I show you my methodologies for finding stuff of interest and how to go down the rabbit hole with your analysis. We cover FNV-1 hashing (something I'd never heard of!) and also variances of the Base64 encoding routine which the bad guys are using the mask their malicious code. This is one of the most fascinating backdoors I've had hands on, and there is much more to come with the analysis and I'd love to hear how you get on pulling a part this code too. Special thanks to the folks at FireEye, their research on this malware is exceptional. LINKS ===== fireeye.com/blog/threat-research/2020/12/evasive-attacker-le… github.com/fireeye/sunburst_countermeasures volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-… us-cert.cisa.gov/ncas/alerts/aa20-352a cyber.dhs.gov/ed/21-01/ en.wikipedia.org/wiki/Fowler%E2%80%93Noll%E2%80%93Vo_hash_fu… TOOLS ====== dnSpy - github.com/dnSpy/dnSpy PeStudio - winitor.com FNV-1 Hashing tool - github.com/cybercdh/hacks/tree/master/sunburst SAMPLE ======= app.any.run/tasks/4fc6b555-4f9b-4346-8df2-b59e5796eb88/ FOLLOW ====== You can join in the conversation by following me at twitter.com/cybercdh THANKS ======= If you LIKED this video, please hit the THUMBS UP. If you LOVED it, please SUBSCRIBE! Many thanks for watching, it means a lot. Peace out. @cybercdh