snowlight | 72afc6b92d0d6ba9f3ca2a3f8f7d4f75464ff6359e32844bed7cb0ec6a9fbc91[.]elf

General

Target
72afc6b92d0d6ba9f3ca2a3f8f7d4f75464ff6359e32844bed7cb0ec6a9fbc91.elf
Size 6KB
Sample261107-bdc11sdf48
SHA256 72afc6b92d0d6ba9f3ca2a3f8f7d4f75464ff6359e32844bed7cb0ec6a9fbc91
MD5 09082ad5ea66b8cc0f1b20058a6c0163
SHA1 3491ccfe6917f34c1d76eed28e74adcd5b54cca1
SHA512 b87e864aaa4112a78756a9056d2be26e005e10d6dab3c6db836f58cf87e611656300f4f7346931749cc6711e812acc7d8f9cef677e3bf443adf66d78f910e339
SSDEEP 96:f6u6TiUBOUw3JJheuhic5Zz/cq/BK+M3mh/W785/f7kbalBgBi5pzBIQ:fEcb5JhAiZz/cl+M2x/fLbpziQ
TLSH
T118E17217E2E2CD32D8D4137E55930A1A223DC8659E83DF132E0C896D2E537DCBA72B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

C2

Family: SnowLight
SnowLight is a loader attributed to China-nexus aka UNC5174.
loader snowlight

Detects SNOWLIGHT Loader 1 IoCs

loader apt unc5174

resource	yara_rule
sample	family_snowlight

SHA256 72afc6b92d0d6ba9f3ca2a3f8f7d4f75464ff6359e32844bed7cb0ec6a9fbc91
MD5 09082ad5ea66b8cc0f1b20058a6c0163
SHA1 3491ccfe6917f34c1d76eed28e74adcd5b54cca1
SHA512 b87e864aaa4112a78756a9056d2be26e005e10d6dab3c6db836f58cf87e611656300f4f7346931749cc6711e812acc7d8f9cef677e3bf443adf66d78f910e339
SSDEEP 96:f6u6TiUBOUw3JJheuhic5Zz/cq/BK+M3mh/W785/f7kbalBgBi5pzBIQ:fEcb5JhAiZz/cl+M2x/fLbpziQ
TLSH
T118E17217E2E2CD32D8D4137E55930A1A223DC8659E83DF132E0C896D2E537DCBA72B56
MD5 SHA1 SHA512 SSDEEP TLSH

linux x86