snowlight | linux_i386

General

Target
linux_i386
Size 7KB
Sample261107-wysmesfg69
SHA256 b52a4dc6d832e20c0f9e43abb7f1b33e3298e369c07fa58a1e0a4de5eb55aa03
MD5 996dc19843274509ab28237ea7ea7e14
SHA1 80830467db8d5430cc24b39337b84b23a4915a23
SHA512 cfc75e20d4c4b438c0ef23c7dd2cb7c9bf27e4cfabe2059dffb9a76dbdbb2d1a1d52de4dced3d90960f1e834d05acded1bfc6167dfd47a0556b6b902ed256a54
SSDEEP 192:fsuqD7vccFF146Lwz7cSym4S2ofahbpZiQ:fsue7cYJ0Fym4Sw/
TLSH
T1F5E16207E2D5CD72D8CD133846931749213AC86EAB83EF03650C5999EE43BDC7A63652
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: SnowLight
SnowLight is a loader attributed to China-nexus aka UNC5174.
loader snowlight

Detects SNOWLIGHT Loader 1 IoCs

loader apt unc5174

resource	yara_rule
sample	family_snowlight

SHA256 b52a4dc6d832e20c0f9e43abb7f1b33e3298e369c07fa58a1e0a4de5eb55aa03
MD5 996dc19843274509ab28237ea7ea7e14
SHA1 80830467db8d5430cc24b39337b84b23a4915a23
SHA512 cfc75e20d4c4b438c0ef23c7dd2cb7c9bf27e4cfabe2059dffb9a76dbdbb2d1a1d52de4dced3d90960f1e834d05acded1bfc6167dfd47a0556b6b902ed256a54
SSDEEP 192:fsuqD7vccFF146Lwz7cSym4S2ofahbpZiQ:fsue7cYJ0Fym4Sw/
TLSH
T1F5E16207E2D5CD72D8CD133846931749213AC86EAB83EF03650C5999EE43BDC7A63652
MD5 SHA1 SHA512 SSDEEP TLSH

linux x86