snowlight | 4a8964af2e18154b1234b5131d0c5e1efa5cbcaa6d2b754ed2e0e17cfae9004f[.]elf

General

Target
4a8964af2e18154b1234b5131d0c5e1efa5cbcaa6d2b754ed2e0e17cfae9004f.elf
Size 6KB
Sample261110-eqa9qscg62
SHA256 4a8964af2e18154b1234b5131d0c5e1efa5cbcaa6d2b754ed2e0e17cfae9004f
MD5 33552057e254bba0ff19f255993b5fe3
SHA1 93d1aa28becd1ed24afde1ea5ec61bb021c4d878
SHA512 30b3ff031629e1637795ecd435f03aa0de14f448fe868db8c0a53f4b4188d76f8541edeed7292f6980f061e34b16b6e041256f53b5a4ffcf2d1cd7b072a47b02
SSDEEP 96:f6u6TiUBOUw3ZJheuhiY5Zz/cq/BK+M3mh/W785/f7kbalBgBi5pzBIQ:fEcbpJhAuZz/cl+M2x/fLbpziQ
TLSH
T1EAE16217E2E2CD32D8D4137E55930A1A223DC8659E83DF132E0C896D2E537DCBA72B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

C2

Family: SnowLight
SnowLight is a loader attributed to China-nexus aka UNC5174.
loader snowlight

Detects SNOWLIGHT Loader 1 IoCs

loader apt unc5174

resource	yara_rule
sample	family_snowlight

SHA256 4a8964af2e18154b1234b5131d0c5e1efa5cbcaa6d2b754ed2e0e17cfae9004f
MD5 33552057e254bba0ff19f255993b5fe3
SHA1 93d1aa28becd1ed24afde1ea5ec61bb021c4d878
SHA512 30b3ff031629e1637795ecd435f03aa0de14f448fe868db8c0a53f4b4188d76f8541edeed7292f6980f061e34b16b6e041256f53b5a4ffcf2d1cd7b072a47b02
SSDEEP 96:f6u6TiUBOUw3ZJheuhiY5Zz/cq/BK+M3mh/W785/f7kbalBgBi5pzBIQ:fEcbpJhAuZz/cl+M2x/fLbpziQ
TLSH
T1EAE16217E2E2CD32D8D4137E55930A1A223DC8659E83DF132E0C896D2E537DCBA72B56
MD5 SHA1 SHA512 SSDEEP TLSH

linux x86