TF-2020227
high
📛 Threat Title
SNOWLIGHT: SHA256 hash of a malware sample (payload) ef40bfccaffca5be53ebd327ccac9642daa97b9cf64837ba049a73c54e02ded7
Description
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: SNOWLIGHT. Confidence: 95. First seen: 2026-11-08 05:57:58 UTC. Reporter: Tuxxin. Tags: elf, SNOWLIGHT.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
ef40bfccaffca5be53ebd327ccac9642daa97b9cf64837ba049a73c54e02ded7
IOC database
- Type
- hash_sha256
- Value
ef40bfccaffca5be53ebd327ccac9642daa97b9cf64837ba049a73c54e02ded7- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- Snowlight
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: SNOWLIGHT. Confidence: 95. First seen: 2026-11-08 05:57:58 UTC. Reporter: Tuxxin. Tags: elf, SNOWLIGHT.
Remediations (10)
-
web:bazaar.abuse.ch
A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as SNOWLIGHT .
-
web:bazaar.abuse.ch
You are currently viewing the MalwareBazaar entry for SHA256 ef40bfccaffca5be53ebd327ccac9642daa97b9cf64837ba049a73c54e02ded7 . While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
-
web:ismalicious.com
SNOWLIGHT sample 34b164db13fc9ec00a1fcf9a142bec0346009041a939f75da21f7239ea49e76e: listed by 4 threat sources ( malware , c2). File type, signatures, hashes, reports.
-
web:ismalicious.com
146 indicators of compromise attributed to the SNOWLIGHT malware family — domains, IPs, URLs and file hashes, from abuse.ch feeds.
-
web:malpedia.caad.fkie.fraunhofer.de
According to sysdig, SNOWLIGHT is used as a dropper for its fileless payload (vshell).
-
web:securityarsenal.com
OTX pulse: Chinese-language fake-resume executable delivers SNOWLIGHT stager and VShell RAT via fileless Go loader with sandbox evasion, targeting academic users.
-
web:socradar.io
Payload Analysis The malware suite evaluated in this section has been definitively identified as SNOWLIGHT . This threat toolkit includes a shell dropper alongside four architecture-specific ELF loaders, which function as the core payloads for the CVE-2026-34486 curl|sh command sequences targeting Taiwanese servers.
-
web:threatfox.abuse.ch
ThreatFox Database Indicators of Compromise (IOCs) on ThreatFox are associated with a certain malware fas. A malware sample can be associated with only one malware family. The page below gives you an overview on indicators of compromise associated with elf. snowlight . You can also get this data through the ThreatFox API. Database Entry
-
web:threatfox.abuse.ch
SNOWLIGHT IOC: e1daffac230c8875c2562831aa5b7af21a91d1585ad390e7b69a45aca5d05d95 ( sha256_hash ) You are viewing the ThreatFox database entry for sha256_hash ...
-
web:www.sysdig.com
The SNOWLIGHT malware acts as a dropper for a fileless payload that resides solely in memory, called VShell. VShell is a Remote Access Trojan (RAT) popular among Chinese-speaking cybercriminals in several forums, and its main developer is also a Chinese speaker.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.