snowlight | 5fe56c1a9bd8e371[.]elf

General

Target
5fe56c1a9bd8e371.elf
Size 6KB
Sample261110-emfp2scg44
SHA256 5fe56c1a9bd8e37177b2ec2ef21d120882bb10832b672b20e18077c1fda34034
MD5 acaf3826eecd6641ee69ab6587b3f366
SHA1 e4e9652deca500f1b4798eccc9fd458d0f321a91
SHA512 1480a2cb9fd0a77b2c53d3289f5e1ff5ad0b6190123a6b5306e2bc0616d066b1b6e01be8715d3b557ee14a0303a1a4eeae3ab35ba9237ff241f77e4e38726565
SSDEEP 96:f6u6TiUBOUw3PJheuhilu5Zz/cq/BK+M3mh/W785/f7kbalBgBi5pzBIQ:fEcb/JhAyZz/cl+M2x/fLbpziQ
TLSH
T1B2E17117E2E2CD32D8D4137E45930A1A223DC8659E83DF132E0C896D2E537DCBA72B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

C2

Family: SnowLight
SnowLight is a loader attributed to China-nexus aka UNC5174.
loader snowlight

Detects SNOWLIGHT Loader 1 IoCs

loader apt unc5174

resource	yara_rule
sample	family_snowlight

SHA256 5fe56c1a9bd8e37177b2ec2ef21d120882bb10832b672b20e18077c1fda34034
MD5 acaf3826eecd6641ee69ab6587b3f366
SHA1 e4e9652deca500f1b4798eccc9fd458d0f321a91
SHA512 1480a2cb9fd0a77b2c53d3289f5e1ff5ad0b6190123a6b5306e2bc0616d066b1b6e01be8715d3b557ee14a0303a1a4eeae3ab35ba9237ff241f77e4e38726565
SSDEEP 96:f6u6TiUBOUw3PJheuhilu5Zz/cq/BK+M3mh/W785/f7kbalBgBi5pzBIQ:fEcb/JhAyZz/cl+M2x/fLbpziQ
TLSH
T1B2E17117E2E2CD32D8D4137E45930A1A223DC8659E83DF132E0C896D2E537DCBA72B56
MD5 SHA1 SHA512 SSDEEP TLSH

linux x86