snowlight | linux_i386

General

Target
linux_i386
Size 7KB
Sample260928-pp7awsvxav
SHA256 90cac0691d531c01a9d2dd8340141f55080e889d3d13f2a9c04972c3c4fea1dd
MD5 0a313ad48e728b6c17ad19d61fc67f17
SHA1 ca002d49ffdf8fccdcfc6bb6370d0db10420c2ed
SHA512 54f9a6a59f9cd83d367495c2c00a7efd18d0c64bcaf5a8ae46fff54b28badc7c1a2a6340afd034207ad047c0a30fb894c7773450f0644da7c441f1b6a75685e2
SSDEEP 192:fsuqD7vccFc1465wz7cSym4S2ofahbpZiQ:fsue7cPJiFym4Sw/
TLSH
T132E15207E2D5CE72D8CD133846935749213AC86EAB83AF03650C599AEE43BDC7A63652
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: SnowLight
SnowLight is a loader attributed to China-nexus aka UNC5174.
loader snowlight

Detects SNOWLIGHT Loader 1 IoCs

loader apt unc5174

resource	yara_rule
sample	family_snowlight

SHA256 90cac0691d531c01a9d2dd8340141f55080e889d3d13f2a9c04972c3c4fea1dd
MD5 0a313ad48e728b6c17ad19d61fc67f17
SHA1 ca002d49ffdf8fccdcfc6bb6370d0db10420c2ed
SHA512 54f9a6a59f9cd83d367495c2c00a7efd18d0c64bcaf5a8ae46fff54b28badc7c1a2a6340afd034207ad047c0a30fb894c7773450f0644da7c441f1b6a75685e2
SSDEEP 192:fsuqD7vccFc1465wz7cSym4S2ofahbpZiQ:fsue7cPJiFym4Sw/
TLSH
T132E15207E2D5CE72D8CD133846935749213AC86EAB83AF03650C599AEE43BDC7A63652
MD5 SHA1 SHA512 SSDEEP TLSH

linux x86