snowlight | linux_amd64

General

Target
linux_amd64
Size 9KB
Sample261107-wtbhcady5z
SHA256 4dd7e0867b639e35dc6021d37146a1793497bd0f3b6ecee2f4b2b4a2a803dd33
MD5 9e840b15ccebe7d5e01471d6ed188c1c
SHA1 d4198a95ed3b6f752cde14c7945796a1873e9efb
SHA512 fdec0cbb773d52bfeb08d46124206d25a0378c19dc4bf0e86f582c75c3f3c24ef636e4f47eea014739d2c2f5e8b515ef3aef8742199585f98ffe02a1dcd6a328
SSDEEP 96:GjOTpJ4WHbHf5jlTTej6TNJ9VZNddfs2oYJYoBSf7meaamBFBp8hBdZvZ4:G6z4WTjTTfTpVBdfs2So8f2Tr8h3
TLSH
T1B1125147A2D1CE7FC8E813384457122472BBD47ADFA29713060C65766E923DC1E6DF8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

C2

Family: SnowLight
SnowLight is a loader attributed to China-nexus aka UNC5174.
loader snowlight

Detects SNOWLIGHT Loader 1 IoCs

loader apt unc5174

resource	yara_rule
sample	family_snowlight

SHA256 4dd7e0867b639e35dc6021d37146a1793497bd0f3b6ecee2f4b2b4a2a803dd33
MD5 9e840b15ccebe7d5e01471d6ed188c1c
SHA1 d4198a95ed3b6f752cde14c7945796a1873e9efb
SHA512 fdec0cbb773d52bfeb08d46124206d25a0378c19dc4bf0e86f582c75c3f3c24ef636e4f47eea014739d2c2f5e8b515ef3aef8742199585f98ffe02a1dcd6a328
SSDEEP 96:GjOTpJ4WHbHf5jlTTej6TNJ9VZNddfs2oYJYoBSf7meaamBFBp8hBdZvZ4:G6z4WTjTTfTpVBdfs2So8f2Tr8h3
TLSH
T1B1125147A2D1CE7FC8E813384457122472BBD47ADFA29713060C65766E923DC1E6DF8A
MD5 SHA1 SHA512 SSDEEP TLSH

linux x64