Solarwinds DLL Quick Overview
Hash and certificate stamp: Filename: solarwinds.orion.core.businesslayer.dll MD5: 846E27A652A5E1BFBD0DDD38A16DC865 sha1: D130BD75645C2433F88AC03E73395FBA172EF676 sha256: CE77D116A074DAB7A22A0FD4F2C1AB475F16EEC42E1DED3C0B0AA8211FE858D6 imphash: DAE02F32A21E03CE65412F6E56942DAA description: SolarWinds.Orion.Core.BusinessLayer file-type: dynamic-link-library certificate-stamp:0xB9480000 (Tue Jan 21 01:00:00 2020) Code Analysis: Part One: // SolarWinds.Orion.Core.BusinessLayer.OrionImprovementBusinessLayer // Token: 0x06000057 RID: 87 RVA: 0x00004F8C File Offset: 0x0000318C private static void DelayMs(double minMs, double maxMs) { if ((int)maxMs == 0) { minMs = 1000.0; maxMs = 2000.0; } double num; for (num = minMs + new Random().NextDouble() * (maxMs – minMs); num >= 2147483647.0; num -= 2147483647.0) { Thread.Sleep(int.MaxValue); } Thread.Sleep((int)num); NOTE: sleeps for 24 days Part Two: // SolarWinds.Orion.Core.BusinessLayer.OrionImprovementBusinessLayer // Token: 0x06000055 RID: 85 RVA: 0x00004E14 File Offset: 0x00003014 private static bool GetOrCreateUserID(out byte[] hash64) { string text = OrionImprovementBusinessLayer.ReadDeviceInfo(); hash64 = new byte[8]; Array.Clear(hash64, 0, hash64.Length); if (text == null) […]
Read More →Fake Malwarebytes Site
Recently we came across a fake Malwarebytes site that looked amazing. The site is http://www.malwarebytes-free[.]com/ The below screenshot shows the fake site which as of 4/8/2020 is still live. There is a JavaScript here that redirects the user to a malicious URL that hosts the Fallout Exploit Kit Below is the malicious code […]
Read More →
Malwarebytes- A week in security (October 26 – November 1) November 2, 2026A list of topics we covered in the week of October 26 to November 1 of 2026
- Fake PDF and search tools hijacked searches for 13.4 million Chrome users October 30, 2026319 Chrome extensions sent search queries through servers controlled by their operators, allowing them to see what users searched for.
- Photo ID, bank checks, face scan? The UK’s age-check options October 30, 2026Ofcom has set out four possible age-verification methods for UK’s under-16 social media ban.
- A week in security (October 26 – November 1) November 2, 2026
- The Hacker News
- New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value November 2, 2026Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value. Like other typical stealer families, VOLTA is equipped to harvest passwords and cookies from Chromium-based web browsers; data from Outlook profiles and Slack […]
- CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key November 1, 2026A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To do it, the attacker had to reach their HTTPS API over the network and have the trusted client's public certificate. Once in, the attacker would act as that client, with access […]
- Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script November 1, 2026Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company. Polymarket says it is refunding about $2.7 million to 726 affected wallets. Blockchain records show crypto worth about $2.64 […]
- FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist November 1, 2026The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets from Binance to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899. The FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue […]
- NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection November 1, 2026Cybersecurity researchers have disclosed details of what has been described as a "highly sophisticated infection chain" targeting government organizations in Asia. The activity, detailed by Kaspersky this week, targeted a custom Windows 10 build used exclusively by government entities in Asia and involves the deployment of a previously undocumented .NET assembly-loading framework codenamed
- New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value November 2, 2026