snowlight | 004f037357c74e63ece2cbf06b14c120b9c164cab4916debe57bf29643b3a570[.]elf

General

Target
004f037357c74e63ece2cbf06b14c120b9c164cab4916debe57bf29643b3a570.elf
Size 7KB
Sample261110-epp2hayya1
SHA256 004f037357c74e63ece2cbf06b14c120b9c164cab4916debe57bf29643b3a570
MD5 7886369e4ac3f86a5ded349f1fdb7254
SHA1 ee35e885c95bcf94290fa470b834e385502a126c
SHA512 fd41cf3d5c5b59b6d913efd1b511c791f653d64429c0b1d6d6ab4b289eb6e81c30468198d250d2c9e888471c63b8dccaeea395b9954e759d45288a01f15ac7e5
SSDEEP 192:fsuqD7vccF6146Ewz7cSym4S2ofahbpZiQ:fsue7cVJ/Fym4Sw/
TLSH
T1A2E16207E2D5CE72D8CD133847935749213AC86EAB83EF03650C599AEE43BDC7A63652
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: SnowLight
SnowLight is a loader attributed to China-nexus aka UNC5174.
loader snowlight

Detects SNOWLIGHT Loader 1 IoCs

loader apt unc5174

resource	yara_rule
sample	family_snowlight

SHA256 004f037357c74e63ece2cbf06b14c120b9c164cab4916debe57bf29643b3a570
MD5 7886369e4ac3f86a5ded349f1fdb7254
SHA1 ee35e885c95bcf94290fa470b834e385502a126c
SHA512 fd41cf3d5c5b59b6d913efd1b511c791f653d64429c0b1d6d6ab4b289eb6e81c30468198d250d2c9e888471c63b8dccaeea395b9954e759d45288a01f15ac7e5
SSDEEP 192:fsuqD7vccF6146Ewz7cSym4S2ofahbpZiQ:fsue7cVJ/Fym4Sw/
TLSH
T1A2E16207E2D5CE72D8CD133847935749213AC86EAB83EF03650C599AEE43BDC7A63652
MD5 SHA1 SHA512 SSDEEP TLSH

linux x86