Edgecution Snow Suite Hash String Detection

Duo Tech@duotech

•updated Aug 5, 2026•1•0•0

Detects Edgecution/SNOW malware suite components across the kill chain via known SHA256 file hashes (phishing HTML, AutoHotkey stager, Edgecution ZIP archive, extension background.js, Python native host backdoor) and combinations of embedded code/path strings associated with SNOWGLAZE/SNOWBASIN; requires multiple distinctive strings together to reduce false positives