MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 4bbcf635ecbbca9db3bf09653a150c4324e80f19c3e8c89bb07a00fb16c87e2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 9
| SHA256 hash: | 4bbcf635ecbbca9db3bf09653a150c4324e80f19c3e8c89bb07a00fb16c87e2c |
|---|---|
| SHA3-384 hash: | 4be22db3063313c3ced279785d0641fc25f02bb066b7fd4c49e8ccc24a02b315e3773402cac8ccefe50f5840e99be016 |
| SHA1 hash: | e0ec423541024a0cba925c698fada64f03557e48 |
| MD5 hash: | db3acb4192c448860b9c0d17437e1471 |
| humanhash: | don-ack-ohio-rugby |
| File name: | beacon4.elf |
| Download: | download sample |
| File size: | 44'368'101 bytes |
| First seen: | 2026-11-14 23:29:20 UTC |
| Last seen: | Never |
| File type: | elf |
| MIME type: | application/x-executable |
| ssdeep | 393216:NVfR1Q2ZLTqwQyX3LZG1/a5qnLIz8MmFr75L5SYMB+8bS7OI:Nf05nj0n+B |
| TLSH | T1D4A71767E8D22254C8AEC170D672413BBBB138591B7C13D706A0F3341B77BE09AB6796 |
| gimphash | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| TrID | 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1) |
| Magika | elf |
| Reporter |  rifteyy |
| Tags: | elf hacktool sliver |
Intelligence
File Origin
# of uploads :
1
# of downloads :
67
Origin country :
CZVendor Threat Intelligence
No detections
Verdict:
Unknown
Threat level:
0/10
Confidence:
100%
Tags:
golang
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
x86
Packer:
not packed
Botnet:
unknown
Number of open files:
0
Number of processes launched:
0
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Verdict:
Malicious
File Type:
elf.64.le
Detections:
HEUR:Trojan.Multi.MalGO.gen HEUR:Trojan.Linux.Vilers.b
Status:
terminated
Behavior Graph:
Result
Threat name:
Sliver
Detection:
malicious
Classification:
troj
Score:
56 / 100
Signature
Multi AV Scanner detection for submitted file
Yara detected Sliver Implants
Behaviour
Behavior Graph:
Score:
96%
Verdict:
Malware
File Type:
ELF
Gathering data
Threat name:
Linux.Hacktool.Sliver
Status:
Malicious
First seen:
2026-11-14 23:30:44 UTC
File Type:
ELF64 Little (Exe)
AV detection:
8 of 36 (22.22%)
Threat level:
1/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
3/10
Tags:
discovery linux
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Malware Family:
sliver
Malicious:
True
Tags:
64bit elf debug-check
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
elf 4bbcf635ecbbca9db3bf09653a150c4324e80f19c3e8c89bb07a00fb16c87e2c
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.