SNOWLIGHT

Name: SNOWLIGHT indicators of compromise
Creator: isMalicious
Keywords: SNOWLIGHT, malware, IOC, payload, payload_delivery

Malware Family

124 indicators of compromise attributed to SNOWLIGHT across abuse.ch threat intelligence feeds.

Domains

IPs

URLs

Hashes

100

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

URLs (24)Hashes (100)

For continuous updates, the same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

payloadPayload Delivery

Sample indicators

Indicator	Type
http://113.45.224.122:16688/?h=113.45.224.122&p=16688&t=tcp&a=l64&stage=true	url
http://103.30.76.214:8779/?h=103.30.76.214&p=8779&t=tcp&a=l64&stage=true	url
http://150.109.94.129:443/?h=150.109.94.129&p=443&t=ws&a=l64&stage=true	url
http://192.25.102.246:8088/?h=192.25.102.246&p=8088&t=tcp&a=l64&stage=true	url
http://139.162.80.182/?h=139.162.80.182&p=80&t=tcp&a=l64&stage=true	url
http://134.122.177.37:8084/?h=134.122.177.37&p=8084&t=tcp&a=l32&stage=true	url
http://101.43.115.8:7777/?h=101.43.115.8&p=7777&t=tcp&a=l64&stage=true	url
http://103.30.76.214:8779/?h=103.30.76.214&p=8779&t=ws&a=l64&stage=true	url
http://192.255.236.156:8084/?h=192.255.236.156&p=8084&t=tcp&a=l32&stage=true	url
http://178.16.53.91:8443/?h=178.16.53.91&p=8443&t=tcp&a=l32&stage=true	url
http://139.162.80.182/?h=139.162.80.182&p=80&t=tcp&a=l32&stage=true	url
http://88.216.191.9:8880/?h=88.216.191.9&p=8880&t=tcp&a=l32&stage=true	url
http://103.30.76.206:443/?h=103.30.76.206&p=443&t=tcp&a=l32&stage=true	url
http://43.111.235.219:16667/?h=43.111.235.219&p=16667&t=tcp&a=l64&stage=true	url
http://103.30.76.214:8779/?h=103.30.76.214&p=8779&t=tcp&a=l32&stage=true	url
http://34.92.225.25:8084/?h=34.92.225.25&p=8084&t=tcp&a=l32&stage=true	url
http://113.45.224.122:16688/?h=113.45.224.122&p=16688&t=tcp&a=l32&stage=true	url
http://101.33.45.136:8084/?h=101.33.45.136&p=8084&t=tcp&a=l64&stage=true	url
http://101.33.45.136:8084/?h=101.33.45.136&p=8084&t=tcp&a=l32&stage=true	url
http://193.160.32.138:8085/?h=193.160.32.138&p=8085&t=tcp&a=l32&stage=true	url
ae26d8e0385f9f1e1a0c213b907e7d7aac915803911fbdb0cc11b95316acfed0	hash
e06d884fe36697b80ca12374142c9d0755f16a1bd7e5ec4e141c432827b64b24	hash
0b4820e8fe52ae14b18ce28ace05605609139bf43431859fd1d5f36132af39d9	hash
dc493eb8367b7d68f4d3d9f2a10c495c6a45c33df72fb5a18bdf62b629f69e31	hash
7d260805c9653f49b5b261b9bc22cf1e77d72bc3ac37f4d5463afd54fd1680f8	hash
f8277cac5d21a14431f019563c8211ff2f277fd13191767f6e28a8c833d6a2ec	hash
6ea48a2e6698bbf530245d916b16e1d5bbaabdbba75142e7be3d26de14ba727d	hash
c4c0afa46dbb4ca0a572717ce1a06532bab908d15c3ad4fc0a315638ca2d812c	hash
72f2f27944f3cd8ace05e077d9f6098bf1d33f07bd82167a66ea23b3616747f1	hash
212866079cfd7fe55083ff3efb12ebd00e846381e51b38181cfb583b0382800f	hash
94eb3e7e60a010665022d1d8cd9fd38a3c9e4d08a535f4384b63b95441de2630	hash
d65cddbdda4284ee9585156779256627606757d29665b6339cd9083c64973c5f	hash
e233a9844c3ad1b702eca5ef1cdc46d9cc7e04a43227e483d2bc94d95acc834a	hash
7dd3bc33ca08a9307657ffe327761af370400e00b4531fe0f497ec879ec735bf	hash
b0c97f8415676247b833aba34b74f8923a6aeaedb748e1080784ce7680a72c7d	hash
7875d573ef014091135caa1f194cd5cf2fda027fe99ae51a51674845d059576d	hash
58c4cc8c7cb89d1c5f7e16a948b04879d60275f31d2fad3fc4d54e759b99d472	hash
66d84f2ec76bf0bba458e581e75457b7e9678b16fe4e3f6d383c11cf214eb24e	hash
63feaeb42751c41c33afe388dbc3450e66f59fdf9b680c3889efd8e4f60493ce	hash
c3f27fa88aada79400d7a0ad373347b9b4c0493f2734d68f950019a389cd5123	hash

Another file to check? Run a file hash reputation check.