snowlight | linux_i386

General

Target
linux_i386
Size 6KB
Sample261107-wtb4wady6v
SHA256 70e932349dc7b66666e96951f930b4118215aad3c2a0bc8f5cfd2ba04344c489
MD5 db374ff6e00c41a6e32c88e62650ed42
SHA1 ad353a334e5479ea31914a97cd7f43ba6e2bd456
SHA512 232ebe7bb9c5fb47fd2f704591d8ed9ce3661e0b78aecc6c2314c2894618097ffae051118ed043ccf7154f45a9f174938f5959fb339743c4b404a9459adba127
SSDEEP 96:f6u6TiUBOUw3SIJheuhii5Zz/cq/BK+M3mh/W785/f7kbalBgBi5pzBIQ:fEcb7JhAcZz/cl+M2x/fLbpziQ
TLSH
T13BE17217E2E2CD32D8D4177E45930A1A223DC8659E83DF132E0C896D2E537DCBA72B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

C2

Family: SnowLight
SnowLight is a loader attributed to China-nexus aka UNC5174.
loader snowlight

Detects SNOWLIGHT Loader 1 IoCs

loader apt unc5174

resource	yara_rule
sample	family_snowlight

SHA256 70e932349dc7b66666e96951f930b4118215aad3c2a0bc8f5cfd2ba04344c489
MD5 db374ff6e00c41a6e32c88e62650ed42
SHA1 ad353a334e5479ea31914a97cd7f43ba6e2bd456
SHA512 232ebe7bb9c5fb47fd2f704591d8ed9ce3661e0b78aecc6c2314c2894618097ffae051118ed043ccf7154f45a9f174938f5959fb339743c4b404a9459adba127
SSDEEP 96:f6u6TiUBOUw3SIJheuhii5Zz/cq/BK+M3mh/W785/f7kbalBgBi5pzBIQ:fEcb7JhAcZz/cl+M2x/fLbpziQ
TLSH
T13BE17217E2E2CD32D8D4177E45930A1A223DC8659E83DF132E0C896D2E537DCBA72B56
MD5 SHA1 SHA512 SSDEEP TLSH

linux x86