snowlight | linux_i386

General

Target
linux_i386
Size 7KB
Sample260828-vrvb1a1dma
SHA256 b1167d8837d7e518ad17d16124da1b18d72bf523d8777b9e019492321d7a9d13
MD5 7ad10c2d5d5cbc0a845e761f4fc39622
SHA1 d5622683148aa8ea4624fc8ef41908311b61e515
SHA512 568c3343f8a46384d8cfa9b36ed4e5454383b590dd38e0fb9e3cfb3b1a929cb89b83f338116eec5215a9adb132ab6a37f42465786ca4ada628cf2aebc90d1274
SSDEEP 192:fsuqD7vccFFk146zMwz7cSym4S2ofahbpZiQ:fsue7cSwJz3Fym4Sw/
TLSH
T118E16207E2D5CD72D8CD133846935749213AC86EAB83EF03650C1999EE43BDC7A63752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: SnowLight
SnowLight is a loader attributed to China-nexus aka UNC5174.
loader snowlight

Detects SNOWLIGHT Loader 1 IoCs

loader apt unc5174

resource	yara_rule
sample	family_snowlight

SHA256 b1167d8837d7e518ad17d16124da1b18d72bf523d8777b9e019492321d7a9d13
MD5 7ad10c2d5d5cbc0a845e761f4fc39622
SHA1 d5622683148aa8ea4624fc8ef41908311b61e515
SHA512 568c3343f8a46384d8cfa9b36ed4e5454383b590dd38e0fb9e3cfb3b1a929cb89b83f338116eec5215a9adb132ab6a37f42465786ca4ada628cf2aebc90d1274
SSDEEP 192:fsuqD7vccFFk146zMwz7cSym4S2ofahbpZiQ:fsue7cSwJz3Fym4Sw/
TLSH
T118E16207E2D5CD72D8CD133846935749213AC86EAB83EF03650C1999EE43BDC7A63752
MD5 SHA1 SHA512 SSDEEP TLSH

linux x86