Essential information

Value / Name

5f96a3ba22fefd2ab99e3cc2df68fc6992d58e1f

Confidence

100/100

Revoked

Yes

Valid from

25/03/2024 14:13

Valid until

28/06/2025 15:13

Pattern type

yara

Published

20/12/2025 19:43

Modified

21/12/2025 03:52

Author / Source

AlienVault

Description

Pattern

rule M_APT_Downloader_SNOWLIGHT_1   
   {   
     meta:   
       author = "Mandiant"   
       description = "This rule is designed to detect the SNOWLIGHT code family"   
       md5 = "0951109dd1be0d84a33d52c135ba9c97"   
       platforms = "Linux"   
       malware_family = "SNOWLIGHT"   
     strings:   
       $xor99 = { 80 31 99 48 FF C1 89 CE 29 EE 39 C6 7C F2 48 63 D2 48 89 EE 44 89 E7 }   
       $memfdcreate = { BA 01 00 00 00 BE 3B 0B 40 00 BF 3F 01 00 00 E8 8C FE FF FF }   
     condition:   
       uint32(0) == 0x464c457f and all of them   
   }

Labels / Tags

Labels: cve202346747 f5 bigip shell unc5174

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.