UNC5174のWindows版マルウェアSNOWLIGHT
ID: 8fdfafc8-cc61-51b5-b799-13a929d766cf
STIX ID: report--8fdfafc8-cc61-51b5-b799-13a929d766cf
Feed Name: IIJ Security Diary
Threat Score
This report analyzes a Windows variant of the SNOWLIGHT downloader and the Go-based VShell RAT observed in October 2025 and attributed to UNC5174 (possibly linked to China MSS). It documents the loader and shellcode execution flow (mutex use, XOR-decoded payloads, API hashing), C2 HTTP/WebSocket communications, related samples and domains/IPs, and provides SHA256 IoCs to support detection and response.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.