snowlight | 1141e2d802d0ef5bfbf8803d7b45882af1eb74be82026b5cb714f8c2ad7e0801[.]elf

General

Target
1141e2d802d0ef5bfbf8803d7b45882af1eb74be82026b5cb714f8c2ad7e0801.elf
Size 9KB
Sample261108-a2falswxcs
SHA256 1141e2d802d0ef5bfbf8803d7b45882af1eb74be82026b5cb714f8c2ad7e0801
MD5 8bd147ccd56e17c60faff31367c99208
SHA1 51162cdea7f086b54a365e734a15a81ed78b797e
SHA512 65e89aa42420465013635eee8a57dc1d9940e55830a8aa62d89e7f5da72440936ba516de5edd8a2ed46ecffbd0f10cb5cde975d38256ee761eb8f2c2156b3ef5
SSDEEP 96:GqTVJWWGXzS6pH5ML09V1J9G8Ym60+hrsrwegVekrf7mxaamBFBp8sBRnsH5vZAC:GqnWWHKZMWT1YmmhrsnurfjTr8sbnsl
TLSH
T15B123047A2D0CE3FC8D953384467122472B794BEDF629713064915B63F427E81E6EB8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

C2

Family: SnowLight
SnowLight is a loader attributed to China-nexus aka UNC5174.
loader snowlight

Detects SNOWLIGHT Loader 1 IoCs

loader apt unc5174

resource	yara_rule
sample	family_snowlight

SHA256 1141e2d802d0ef5bfbf8803d7b45882af1eb74be82026b5cb714f8c2ad7e0801
MD5 8bd147ccd56e17c60faff31367c99208
SHA1 51162cdea7f086b54a365e734a15a81ed78b797e
SHA512 65e89aa42420465013635eee8a57dc1d9940e55830a8aa62d89e7f5da72440936ba516de5edd8a2ed46ecffbd0f10cb5cde975d38256ee761eb8f2c2156b3ef5
SSDEEP 96:GqTVJWWGXzS6pH5ML09V1J9G8Ym60+hrsrwegVekrf7mxaamBFBp8sBRnsH5vZAC:GqnWWHKZMWT1YmmhrsnurfjTr8sbnsl
TLSH
T15B123047A2D0CE3FC8D953384467122472B794BEDF629713064915B63F427E81E6EB8B
MD5 SHA1 SHA512 SSDEEP TLSH

linux x64