SUSP_Go_LibP2P_Library_Aug26

Rule Info

Name
SUSP_Go_LibP2P_Library_Aug26
Author
Florian Roth
Description
Detects Go binaries using the libp2p library - a peer-to-peer networking library seen being used in implants and C2 frameworks
Score
60
Reference
https://github.com/libp2p/go-libp2p/
Date
2026-08-24
Modified
2026-08-25
Minimum Yara
3.5.0
Rule Hash
7789ddedbae008829782f64c538ab9d1
Tags
['EXE', 'FILE', 'SUSP']
Required Modules
[]
Virustotal Matches
https://www.virustotal.com/gui/search/susp_go_libp2p_library_aug26/comments

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
4
Suspicious (< 10 engines)
2
Clean (0 engines)
5

Rule Matches

Timestamp
Positives
Total
Hash
VT
2026-09-05 04:29:47
15
59
7711f7212b9561f3ea67c5c5c4d5a058061976b2c1dcb53b636fc45e8edebe27
2026-09-02 05:25:06
2
45
80569fecf0742d538a49a786fa94d9140ae98ce47b0b5f8d6bdf3fbee8cae6ba
2026-09-01 23:08:43
1
44
bfec2c37b6bb8f837d41f13bfb9173e02328d1bfe746c0ed6516a68a7344c54d
2026-08-30 20:41:06
22
70
8d9dc64971ab34043429e0d104bf1c04122a3bbf4e5f1715a5107ba5b494cac9
2026-08-30 20:40:46
15
71
b5a9a37a2a07a8e1be81896b1ab6e4e4458bea8f1902ca617729cbfb719c4793
2026-08-30 19:45:56
0
64
8a821f53786f48d2106a7cbc908c54a827240549102dc14422f8a32235c1534b
2026-08-30 19:45:47
0
64
0536306bb8159d6ef9055638a46b072b272d55a9cf400ae1ea603c0cc872f8ef
2026-08-30 19:45:47
0
64
8fee74787e588d819a766ace2cd46951515122d13c9867dacf2fb7c43666a68e
2026-08-30 19:45:47
0
64
1abea1f70681c8de2c2031743d0ae98bf8c2683715c04f6d02342ad72034c99e
2026-08-30 19:44:26
0
64
5f906094966ee4c89f549c1fc2f4731c461b6867b084316d1c5d10252d8b80d4
2026-08-30 02:48:47
23
64
9007bb4a6b8cdeff55224dbbd4b1516669f0737e5ff4590cd4c5aa9cc5b464ed

Rule Matches per Month (last 24 months)

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022