snowlight | linux_i386

General

Target
linux_i386
Size 7KB
Sample260919-mbrbeaar2x
SHA256 d3397f855bdea91e684190e63bd42404a8d13ff69a6c0cce32877b68a9b5afe6
MD5 cfce6521ad040d03fff7baf5b8b25a3e
SHA1 399389d25362962d789648abcb17ce0d74e8f0bc
SHA512 c7d5d94d4744de5c121a69026f24630df97b9b6e052adc469306e6ba9c2e5039ab640338e7a115aede85f831e30e3ac9f17c5890b69c112889b092c5c84f1e52
SSDEEP 192:fsuqD7vccFg1469wz7cSym4S2ofahbpZiQ:fsue7cfJmFym4Sw/
TLSH
T1CEE16207E2D5CE72D8CD133846931749213AC86EAB83EF03650C19A9EE43BDC7A63752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: SnowLight
SnowLight is a loader attributed to China-nexus aka UNC5174.
loader snowlight

Detects SNOWLIGHT Loader 1 IoCs

loader apt unc5174

resource	yara_rule
sample	family_snowlight

SHA256 d3397f855bdea91e684190e63bd42404a8d13ff69a6c0cce32877b68a9b5afe6
MD5 cfce6521ad040d03fff7baf5b8b25a3e
SHA1 399389d25362962d789648abcb17ce0d74e8f0bc
SHA512 c7d5d94d4744de5c121a69026f24630df97b9b6e052adc469306e6ba9c2e5039ab640338e7a115aede85f831e30e3ac9f17c5890b69c112889b092c5c84f1e52
SSDEEP 192:fsuqD7vccFg1469wz7cSym4S2ofahbpZiQ:fsue7cfJmFym4Sw/
TLSH
T1CEE16207E2D5CE72D8CD133846931749213AC86EAB83EF03650C19A9EE43BDC7A63752
MD5 SHA1 SHA512 SSDEEP TLSH

linux x86