snowlight | linux_i386

General

Target
linux_i386
Size 7KB
Sample261001-pg7lpasgla
SHA256 e6e9002cd80457e3ad09ce85e43aa89174816e5fbc8cec8f9b50a252acd007c2
MD5 8d76d247937991d8eddf764eaa5970d1
SHA1 9b52c02fa27324c93f960e152414947a9f999f1e
SHA512 bcb28cb71650a421764bf8060762f064f7b1afd6f2673468682492fc83dff866a67a9361f8fdf51bf6818b881008de4e280c1d2d931b6a12bc1f8cc13e87087a
SSDEEP 192:fsuqD7vccFq1467wz7cSym4S2ofahbpZiQ:fsue7cFJEFym4Sw/
TLSH
T16CE15207E2D5CD72D8CD133847935749213AC86EAB83AF03650C5999EE43BDC7A63752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: SnowLight
SnowLight is a loader attributed to China-nexus aka UNC5174.
loader snowlight

Detects SNOWLIGHT Loader 1 IoCs

loader apt unc5174

resource	yara_rule
sample	family_snowlight

SHA256 e6e9002cd80457e3ad09ce85e43aa89174816e5fbc8cec8f9b50a252acd007c2
MD5 8d76d247937991d8eddf764eaa5970d1
SHA1 9b52c02fa27324c93f960e152414947a9f999f1e
SHA512 bcb28cb71650a421764bf8060762f064f7b1afd6f2673468682492fc83dff866a67a9361f8fdf51bf6818b881008de4e280c1d2d931b6a12bc1f8cc13e87087a
SSDEEP 192:fsuqD7vccFq1467wz7cSym4S2ofahbpZiQ:fsue7cFJEFym4Sw/
TLSH
T16CE15207E2D5CD72D8CD133847935749213AC86EAB83AF03650C5999EE43BDC7A63752
MD5 SHA1 SHA512 SSDEEP TLSH

linux x86