MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 80729e37f797da2b5a177867306318626e52b675f44fa441c256d139e88f69df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Sliver
Vendor detections: 7
| SHA256 hash: | 80729e37f797da2b5a177867306318626e52b675f44fa441c256d139e88f69df |
|---|---|
| SHA3-384 hash: | f4a97f697fda705c2d11ae0d62204bf5eca7383c1d44c24c338353b2d8ec7653b656b90fb78e13b14e420eeab95857db |
| SHA1 hash: | 7b74e3d0201c6409648300e176abd0c2803ce9c6 |
| MD5 hash: | 1f0f95451783ff3460337e32a46a9e3c |
| humanhash: | skylark-lithium-october-pasta |
| File name: | proxy.sh |
| Download: | download sample |
| Signature | Sliver |
| File size: | 8'477 bytes |
| First seen: | 2025-12-13 10:26:33 UTC |
| Last seen: | Never |
| File type: | sh |
| MIME type: | text/x-shellscript |
| ssdeep | 192:e8GwY9+TaXeXP/gsIaV0g6ztdSzaVQqUx3gFaVuDksIDoEx1dpUvihPEMDWE+Lc:LKRztdSzaVh4gFaVuDfIx3EeWE+Y |
| TLSH | T1180264A09A70E4B67DCA1479473B1246396D704A530D31359AF26848E0FDBCF837DE3A |
| TrID | 70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1) |
| Magika | shell |
| Reporter | Anonymous |
| Tags: | CVE-2025-55182 pcpcat sh sliver teampcp worm |
Anonymous
- Infrastructure behavior:• Fetches batches of ~10,000 domains per cycle
• Scans for vulnerable deployments
• Attempts theft of 30 credential types
• Attempts automated deployment of malware
• Logs successful compromises and failures
- Malware observed:
• PCPcat Scanner (docker, ray)
• React2Shell Scanner
• Redis Scanner
• Sliver Implant binary
• Kubernetes Spread Script
• FRP / Gost tunneling binaries
Shell script dropper
This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.
| URL | Malware sample (SHA256 hash) | Signature | Tags |
|---|---|---|---|
| http://67.217.57.240:666/files/kube.py | n/a | n/a | ascii py |
| http://update.aegis.aliyun.com/download/uninstall.sh | n/a | n/a | ascii |
| https://github.com/fatedier/frp/releases/download/v | n/a | n/a | n/a |
| https://github.com/ginuerzh/gost/releases/download/v | n/a | n/a | n/a |
Intelligence
File Origin
# of uploads :
1
# of downloads :
47
Origin country :
ZAVendor Threat Intelligence
No detections
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
bash lolbin
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-12-13T08:35:00Z UTC
Last seen:
2025-12-13T09:58:00Z UTC
Hits:
~10000
Status:
Failed
Score:
1%
Verdict:
Benign
File Type:
SCRIPT
Verdict:
Malicious
Threat:
Family.SLIVER
Detection(s):
Suspicious file
Result
Malware family:
sliver
Score:
10/10
Tags:
family:sliver antivm backdoor defense_evasion discovery linux persistence privilege_escalation trojan
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
Reads CPU attributes
Creates a large amount of network flows
Enumerates running processes
Legitimate hosting services abused for malware hosting/C2
Modifies systemd
File and Directory Permissions Modification
Detects GOST tunneling tool
Contacts a large (7734) amount of remote hosts
Detects Sliver payload
Sliver RAT v2
Sliver family
SliverRAT
Malware family:
Sliver
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.28
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.