snowlight | linux_i386

General

Target
linux_i386
Size 7KB
Sample260930-ppnhsaxgme
SHA256 2c6540a95dadb52fdeed041b96e20167ec131b656175d79f4ac46ba422fe1348
MD5 90ca95017b3b6469bca098a5d1bbf54c
SHA1 b5b94a732ed6079978eccad6e0531f77fbf9b22b
SHA512 960bcaa3eff5a97152f7226bab6626a3687d26b310d7589b59ef5cb346e2e7bea345207df1ac2b41324073d4ee27051eb8c950397ae35219ea27282a785184de
SSDEEP 192:fsuqD7vccF1146VGwz7cSym4S2ofahbpZiQ:fsue7cYJLFym4Sw/
TLSH
T11BE15207E2D5CD72D8CD133846935749213AC86EAB83AF03650C5999EE43BDC7A63752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: SnowLight
SnowLight is a loader attributed to China-nexus aka UNC5174.
loader snowlight

Detects SNOWLIGHT Loader 1 IoCs

loader apt unc5174

resource	yara_rule
sample	family_snowlight

SHA256 2c6540a95dadb52fdeed041b96e20167ec131b656175d79f4ac46ba422fe1348
MD5 90ca95017b3b6469bca098a5d1bbf54c
SHA1 b5b94a732ed6079978eccad6e0531f77fbf9b22b
SHA512 960bcaa3eff5a97152f7226bab6626a3687d26b310d7589b59ef5cb346e2e7bea345207df1ac2b41324073d4ee27051eb8c950397ae35219ea27282a785184de
SSDEEP 192:fsuqD7vccF1146VGwz7cSym4S2ofahbpZiQ:fsue7cYJLFym4Sw/
TLSH
T11BE15207E2D5CD72D8CD133846935749213AC86EAB83AF03650C5999EE43BDC7A63752
MD5 SHA1 SHA512 SSDEEP TLSH

linux x86