snowlight | linux_i386

General

Target
linux_i386
Size 7KB
Sample261107-pmlleac14l
SHA256 6a6bee03bf9535defc6cfcaf5d9b76b3fa8b8a68bbf539248049c35ebc749ba2
MD5 f5606eb8012d47ed9e8aed3db05b8ef6
SHA1 2e0c7de2efd926eaffcf4c9d7c23b9a67a8ffd8f
SHA512 3f6c79f847944a233a9c0ba240f63d6f317de389e84bba4a043eaf8d6cdcb51705f0913cc85fa6de8ea8624c34b1ddc25b4acb5bd759dd13f303011a08d8c99a
SSDEEP 192:fsuqD7vccFS146Qwz7cSym4S2ofahbpZiQ:fsue7c9JbFym4Sw/
TLSH
T12AE16207E2D5CD72D8CD133847931749213AD86EAB83AF03650C199AEE43BDC7A63652
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: SnowLight
SnowLight is a loader attributed to China-nexus aka UNC5174.
loader snowlight

Detects SNOWLIGHT Loader 1 IoCs

loader apt unc5174

resource	yara_rule
sample	family_snowlight

SHA256 6a6bee03bf9535defc6cfcaf5d9b76b3fa8b8a68bbf539248049c35ebc749ba2
MD5 f5606eb8012d47ed9e8aed3db05b8ef6
SHA1 2e0c7de2efd926eaffcf4c9d7c23b9a67a8ffd8f
SHA512 3f6c79f847944a233a9c0ba240f63d6f317de389e84bba4a043eaf8d6cdcb51705f0913cc85fa6de8ea8624c34b1ddc25b4acb5bd759dd13f303011a08d8c99a
SSDEEP 192:fsuqD7vccFS146Qwz7cSym4S2ofahbpZiQ:fsue7c9JbFym4Sw/
TLSH
T12AE16207E2D5CD72D8CD133847931749213AD86EAB83AF03650C199AEE43BDC7A63652
MD5 SHA1 SHA512 SSDEEP TLSH

linux x86