snowlight | linux_i386[.]elf

General

Target
linux_i386.elf
Size 7KB
Sample261023-c6lpascb43
SHA256 5fbd46e376797b75f5455775d0e62dcfdb30e81375c45fb20e0c31593a37da1b
MD5 2e1f834dbc82a803c93915f229b6110e
SHA1 c7a806a3740ef53f426aee8db77f7e680ba95f82
SHA512 147a2fe7d3771e79b248c8c9543404233aa39e4ccb9c224538db09729cbdf63c00d863339e74e4befb26f91ed5cc0e41ff9e44810b84d1bfde733590876baaf0
SSDEEP 192:fsuqD7vccF+146Iwz7cSym4S2ofahbpZiQ:fsue7cJJjFym4Sw/
TLSH
T1D9E16207E2D5CE72D8CD133846931749213AC86EAB83AF03650C1999EE43BDC7A63752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: SnowLight
SnowLight is a loader attributed to China-nexus aka UNC5174.
loader snowlight

Detects SNOWLIGHT Loader 1 IoCs

loader apt unc5174

resource	yara_rule
sample	family_snowlight

SHA256 5fbd46e376797b75f5455775d0e62dcfdb30e81375c45fb20e0c31593a37da1b
MD5 2e1f834dbc82a803c93915f229b6110e
SHA1 c7a806a3740ef53f426aee8db77f7e680ba95f82
SHA512 147a2fe7d3771e79b248c8c9543404233aa39e4ccb9c224538db09729cbdf63c00d863339e74e4befb26f91ed5cc0e41ff9e44810b84d1bfde733590876baaf0
SSDEEP 192:fsuqD7vccF+146Iwz7cSym4S2ofahbpZiQ:fsue7cJJjFym4Sw/
TLSH
T1D9E16207E2D5CE72D8CD133846931749213AC86EAB83AF03650C1999EE43BDC7A63752
MD5 SHA1 SHA512 SSDEEP TLSH

linux x86