snowlight | ad567b009a2a98b3980dbe403ee16816e04889efda97b2040138b0c8dffdb0ed[.]elf

General

Target
ad567b009a2a98b3980dbe403ee16816e04889efda97b2040138b0c8dffdb0ed.elf
Size 9KB
Sample261110-d65ylscf82
SHA256 ad567b009a2a98b3980dbe403ee16816e04889efda97b2040138b0c8dffdb0ed
MD5 082e8a1af499157367a0806f7f3dd58a
SHA1 62c6d296a67d94b4d9b837acdea2f010d739900b
SHA512 8473c3afe4619d713d82c7ea07d28bd291176229797201c6bc6f63a2f5e6d51d0256663f50dc411191f962c26079e0d095a1c1950e9530305a449b94636352be
SSDEEP 96:GqTVJWWGXzS6WH5ML09V1J9G8Ymw+hrsrwegVekrf7mxaamBFBp8sBRnsH5vZAC:GqnWWHJZMWT1YmphrsnurfjTr8sbnsl
TLSH
T140123047A2D0CE3FC8D9533844A7122472B794BEDF629713064915B53F427E81E6EB8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

C2

Family: SnowLight
SnowLight is a loader attributed to China-nexus aka UNC5174.
loader snowlight

Detects SNOWLIGHT Loader 1 IoCs

loader apt unc5174

resource	yara_rule
sample	family_snowlight

SHA256 ad567b009a2a98b3980dbe403ee16816e04889efda97b2040138b0c8dffdb0ed
MD5 082e8a1af499157367a0806f7f3dd58a
SHA1 62c6d296a67d94b4d9b837acdea2f010d739900b
SHA512 8473c3afe4619d713d82c7ea07d28bd291176229797201c6bc6f63a2f5e6d51d0256663f50dc411191f962c26079e0d095a1c1950e9530305a449b94636352be
SSDEEP 96:GqTVJWWGXzS6WH5ML09V1J9G8Ymw+hrsrwegVekrf7mxaamBFBp8sBRnsH5vZAC:GqnWWHJZMWT1YmphrsnurfjTr8sbnsl
TLSH
T140123047A2D0CE3FC8D9533844A7122472B794BEDF629713064915B53F427E81E6EB8B
MD5 SHA1 SHA512 SSDEEP TLSH

linux x64