SNOWLIGHT

Malware Family

109 indicators of compromise attributed to SNOWLIGHT across abuse.ch threat intelligence feeds.

Domains

IPs

URLs

Hashes

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

URLs (20)Hashes (89)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

payloadPayload Delivery

Sample indicators

Indicator	Type
http://103.30.76.214:8779/?h=103.30.76.214&p=8779&t=tcp&a=l64&stage=true	url
http://192.25.102.246:8088/?h=192.25.102.246&p=8088&t=tcp&a=l64&stage=true	url
http://150.109.94.129:443/?h=150.109.94.129&p=443&t=ws&a=l64&stage=true	url
http://134.122.177.37:8084/?h=134.122.177.37&p=8084&t=tcp&a=l32&stage=true	url
http://139.162.80.182/?h=139.162.80.182&p=80&t=tcp&a=l64&stage=true	url
http://192.255.236.156:8084/?h=192.255.236.156&p=8084&t=tcp&a=l32&stage=true	url
http://103.30.76.206:443/?h=103.30.76.206&p=443&t=tcp&a=l64&stage=true	url
http://103.30.76.214:8779/?h=103.30.76.214&p=8779&t=ws&a=l64&stage=true	url
http://130.94.30.168:8080/?h=130.94.30.168&p=8080&t=tcp&a=l32&stage=true	url
http://139.162.80.182/?h=139.162.80.182&p=80&t=tcp&a=l32&stage=true	url
http://178.16.53.91:8443/?h=178.16.53.91&p=8443&t=tcp&a=l32&stage=true	url
http://103.30.76.206:443/?h=103.30.76.206&p=443&t=tcp&a=l32&stage=true	url
http://88.216.191.9:8880/?h=88.216.191.9&p=8880&t=tcp&a=l32&stage=true	url
http://43.111.235.219:16667/?h=43.111.235.219&p=16667&t=tcp&a=l64&stage=true	url
http://103.30.76.214:8779/?h=103.30.76.214&p=8779&t=tcp&a=l32&stage=true	url
http://34.92.225.25:8084/?h=34.92.225.25&p=8084&t=tcp&a=l32&stage=true	url
http://101.33.45.136:8084/?h=101.33.45.136&p=8084&t=tcp&a=l64&stage=true	url
http://130.94.30.168:8080/?h=130.94.30.168&p=8080&t=tcp&a=l64&stage=true	url
http://101.33.45.136:8084/?h=101.33.45.136&p=8084&t=tcp&a=l32&stage=true	url
http://193.160.32.138:8085/?h=193.160.32.138&p=8085&t=tcp&a=l32&stage=true	url
a56336c4298d6717797c71d34cb627c8aa29ecd5c56775d520d3309fe21101d9	hash
644be4b51187b204f579dcb3a9cf0da944b2026ef0aff00b168b9f6ca57228ac	hash
7592b18d8030ccc949b3cc7b22c14d3bd8d7d913f502ed8d805787e1baaa94a8	hash
517834a3d461299a404c76c7664b915fe5d1e450a2a764ae5badfa6ce6dcaa74	hash
b9533ce8e428f16f3d0e1946f19a6f756ff11a532d0b7e61ae402837f46c678e	hash
bddb47cc8940fcfee7d6066c9e15d6e040b8cb1fbd06c622fb1df4bdf2b31c24	hash
1dfa69826e4ac3ec19da8e653ea207232e2814029d7ed6699ee3aeb28998216a	hash
5307abb737f2a578602f15e35060d8e83cd9063417e745d1cc138bf421c1141f	hash
86b9ddeb528f6f6452d5b6eb209055f6c0378b5a2c2217e257209395e1d3a09a	hash
717ef54202f539acf807201f8be6bf5e2c0e90dad512092675718e4c01d12e32	hash
30fbfca5c205f6496891e7cb390c10fd7cf6518e593c31fbf24a31b775b64d87	hash
e09af9f084075caf754e2cbefbb360c851bb279c2dd8b4d383209aef64af20ef	hash
0377328b77a71491581e34aad9f57b6d581681c614846157c0cc0de7859ce6f7	hash
36dabc40fa8983ce900a90b8156d2c754875fe1b5413a997843c4a0ef3908220	hash
464313f7abdd36fac487c35a5380a0f4f122f60ba5b43cd5f14d409369128af2	hash
4fac6b5ac4fa64cf89eb20d71cef09ec3bf0c22fd5112f7ceacc5aa344bbc668	hash
66d84f2ec76bf0bba458e581e75457b7e9678b16fe4e3f6d383c11cf214eb24e	hash
60d18a0c9029b527e71a0b54600d8c7feab14190e9b911fd2bc18e75bd7b60ff	hash
30cd9a7ab6c64811b2816d89b28627e70348c7eb2cb488571f70c242221cbd25	hash
d285e850768951f5837339bbcbba1ed22d41f8e9a42ab9c2ad7cd31c03fcdf5b	hash

Another file to check? Run a file hash reputation check.