Advent of Configuration Extraction

This report analyzes SNOWLIGHT, a sub-10KB ELF downloader used in intrusion campaigns attributed to UNC5174 that fetches a XOR-encoded payload over raw TCP and executes it in-memory via memfd_create/fexecve. It documents an automated extractor that (1) locates the C2 string in .rodata (consistently after the marker "[kworker/0:2]"), (2) rebuilds GOT/PLT mappings using LIEF to identify dynamic calls (notably gethostbyname), and (3) disassembles main with Capstone to recover the hard-coded network port (e.g., 8065), enabling reliable configuration extraction from variants.