Appendix: Timeline, IOCs, and Artifact Map

Reference back matter for the book, consolidated from the technical analysis and public reporting cited throughout the chapters. External network indicators are defanged; file hashes are verbatim. Provenance flags from the chapters apply: compile timestamps are locally verified; day-level 2019 dates are secondary reporting; the valid Authenticode signature is vendor-documented, not verified here.

A. Master timeline

B. SUNBURST DLL hashes (locally verified)

C. SUNBURST network / C2 indicators

All stored base64+DEFLATE-obfuscated in the DLL; decoded in Chapter 4.

• C2 base domain: avsvmcloud[.]com (per-victim subdomains are DGA-generated at runtime, not stored)
• C2 subdomain label: appsync-api → *.appsync-api.<region>.avsvmcloud[.]com
• Region labels: us-east-1, us-east-2, us-west-2, eu-west-1
• Benign cover precheck host: api.solarwinds[.]com
• HTTP URI cover paths: swip/upd/..., swip/Upload.ashx, swip/Events, pki/crl/{0}{1}{2}.crl, fonts/woff/...woff2
• User-Agent strings: SolarWindsOrionImprovementClient/<ver>, Microsoft-CryptoAPI/
• DGA substitution alphabets: ph2eifo3n5utg1j8d94qrvbmk0sal76c, rq3gsalt6u1iyfzop572d49bnx8cvmkewhj
• Actor authoritative NS (passive DNS): ns1.avsvmcloud[.]com → 54.164.147.101; ns2.avsvmcloud[.]com → 3.101.88.204

D. SUNBURST host-based artifacts

• Single-instance pipe / appId GUID: 583da945-62af-10e8-4902-a8f205c72b2e
• Victim ID source: HKLM\SOFTWARE\Microsoft\Cryptography → MachineGuid (+ AD domain + first MAC)
• Service enumeration / tamper target: HKLM\SYSTEM\CurrentControlSet\services (Start = 4 disables a service)
• Persisted state flags (.config appSettings): ReportWatcherRetry, ReportWatcherPostpone (+ ReportStatus.Truncate = self-disabled)
• Dropped path reference: \OrionImprovement\SolarWinds.OrionImprovement.exe
• Host process gate: GetHash("solarwinds.businesslayerhost") == 17291806236368054941
• Name hash function: FNV-1a-64 with final XOR 0x5BAC903BA7D81967
• Domain-skip filters: (?i)(solarwinds), (?i)…(test)…
• Evasion blocklist: 188 unique values across 189 array slots (137 process slots / 136 unique process names, 17 drivers, 22 services, 13 domains), 100% recovered

E. The 22 nList signalling ranges

The implant’s behaviour is driven by which range the resolved avsvmcloud[.]com IP falls into (escalate / stand-down / reset; see Chapters 4 §4.5 and 5 §5.4):

10.0.0.0/8      172.16.0.0/12    192.168.0.0/16   224.0.0.0/4      (private/multicast)
fc00::          fec0::           ff00::                            (IPv6 ULA/link/multicast)
41.84.159.0/24  74.114.24.0/21   154.118.140.0/24 217.163.7.0/24
20.140.0.0/15   96.31.172.0/24   131.228.12.0/22  144.86.226.0/24
8.18.144.0/23   18.130.0.0/16*   71.152.53.0/24   99.79.0.0/16*
87.238.80.0/21  199.201.117.0/24 184.72.0.0/15*

* marks the three NetBios entries constructed with ext: true in the implant.

The 15 Dec 2020 killswitch repointed avsvmcloud[.]com to 20.140.0.1, inside the stand-down range 20.140.0.0/15. An implant still resolving through this initial DNS path would interpret the answer as its own disable directive; already handed-off hosts required separate remediation (Chapter 8).

F. Companion sample hashes (SHA-256)

Standalone samples examined for this book: second-stage and related tooling, separate from the four installers.

G. Second- and later-stage indicators

• TEARDROP: disguised payload festive_computer.jpg (vendor sibling: gracious_truth.jpg); maps BEACON in memory via VirtualProtect(PAGE_EXECUTE_READWRITE). FireEye published the APT_Dropper_*_TEARDROP YARA rules.
• SIBOT: C2 https://thewire.hologic[.]com/includes; drop c:\windows\system32\drivers\netioc.sys; exec rundll32 netioc.sys,NdfRunDllDuplicateIPDefendingSystem (WMI); persistence HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot; UA Chromium/78.0.3882.0 Linux.
• GoldMax/SUNSHUTTLE: C2 reyweb[.]com (and sibling nikeoutletinc[.]org); config.dat (AES-CFB + base64); IP 185.225.69.69; UA Firefox 75 (sibling Firefox 68); command marker ubFxROBRwfswVRWNjLC (rotated per build).

H. Evidence → section map