File scan report
Verdict Safe
Is Soulseek
This SoulseekQt Linux AppImage drew no detections from any of 75 antivirus engines, has circulated widely for over two years, and behaved like a normal desktop application in…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
This AppImage can be used normally; obtain updates from the official Soulseek site and scan files downloaded through the peer-to-peer network before opening them.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 63 flagged
- Flagged 0
- No detection 63
- No result 12
- Code signing Not applicable
- Test run Completed
- First seen 2y ago
Chapter 02
Why we think so
0 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 63 antivirus engines that checked it flagged this SoulseekQt AppImage, including all 18 major antivirus engines that analysed it. It has been submitted by over 300 different sources since mid-2024. In sandbox testing it only unpacked itself and started a desktop session bus, and no contacted host is known to be malicious.
None of the 63 antivirus engines that checked it flagged this file, and all 18 major antivirus engines that analysed it returned clean results. The file is long-established, with over 300 distinct submitters across more than two years, which fits a widely downloaded release of the Soulseek file-sharing client. Sandbox execution showed only the AppImage mounting itself, launching its AppRun entry point and starting a D-Bus session, with no injection, persistence or high-risk techniques. All 13 contacted hosts were checked against our reputation data and none were flagged; they belong to Ubuntu and GNOME desktop infrastructure. Code signing does not apply to this Linux package format, so its absence is neutral.
What We Detected
None of the 63 antivirus engines that checked it flagged this Linux AppImage, and every major antivirus engine that analysed it reported it clean. The file has been in circulation since July 2024 and was submitted by over 300 distinct sources.
Threat Behavior
In sandbox execution the package mounted itself, ran its AppRun launcher and started a D-Bus session, which is typical for a Qt desktop application. No process injection, persistence or high-risk techniques were recorded, and the sandbox run returned clean. All contacted hosts were checked and none are known to be malicious. They are Ubuntu, Snap and GNOME services commonly reached by the test desktop.
What To Do Now
The evidence supports using this file. As with any peer-to-peer client, download it from the official Soulseek website and scan the files you receive through the network before opening them.
Where this verdict could be wrong1 caveat
- The sandbox tags note debug-environment detection, but self-extracting AppImage runtimes and Qt apps commonly perform such environment checks, and nothing hostile followed.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No detections from any of the 75 antivirus engines, including all major antivirus engines
- Widely distributed: over 300 distinct submitters across more than two years
- The sandbox run returned clean, with no injection or persistence
- None of the contacted hosts are known to be malicious
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 8sandbox rule tags
- 9spawned processes
- 13network contacts
- 1filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
8MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1497.001· Sandbox evasion
- T1518.001· Checks your AV
- T1564.001· Hides artifacts
Observed activity
Processes started
9Programs the file ran, with their command lines.
shsh -c /tmp/SoulseekQt-2024-6-30.AppImageSoulseekQt-2024-6-30.AppImage/tmp/SoulseekQt-2024-6-30.AppImageAppRun/tmp/.mount_SoulseCY6KaH/AppRun /tmp/SoulseekQt-2024-6-30.AppImageSoulseekQt-2024-6-30.AppImage/tmp/SoulseekQt-2024-6-30.AppImage -dbus-launch/usr/bin/dbus-launch dbus-launch --autolaunch a39eb3ed78b7401fb6809ed0c562a5b1 --binary-syntax --close-stderrdbus-launch/usr/bin/dbus-launch -
Show all 9 entries for processes started
dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --sessiondbus-daemon/usr/bin/dbus-daemon -python3.8/usr/bin/python3.8 -
Network contacts
1313 hosts, listed as 6 domains, 7 addresses. Links show the host and path only.
- Domain
extensions.gnome.org - Domain
cdn.fwupd.org - Domain
odrs.gnome.org - Domain
api.snapcraft.io - Domain
dashboard.snapcraft.io - Domain
motd.ubuntu.com
Show all 13 entries for network contacts
- IP address
151.101.1.91 - IP address
151.101.2.49 - IP address
185.93.1.25 - IP address
185.125.188.55 - IP address
185.125.188.59 - IP address
54.247.62.1 - IP address
185.125.188.61
Files
1Files the file created, changed or deleted.
- Written
/root/.dbus/session-bus/a39eb3ed78b7401fb6809ed0c562a5b1-0
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- bd80399867eba5ffdcc5…5d75dbNot checkedno saved verdict
Chapter 04
Technical details
None of the 63 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 14, 2026, 10:50 PM UTC
- SHA-256
332d9369f0746f1fdd72c77027915983a155165800c9fab991c110601a870f3b- SHA-1
ef5ff38249f5285e628f450878fb2f720c0c05bb- MD5
bc985d49f30df0f5adb7b13518e068d2
About this file
SoulseekQt-2024-6-30.AppImage is an ELF file of 53.6 MB.
- Type and size
- ELF · 53.6 MB
- Signer
- Not applicable
- First seen
- Jul 22, 2024On VirusTotal.
- Submitted by
- 310 distinct sources
First scanned Updated
Antivirus consensus
0 of 63 engines flagged this file
12 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-234 engines0flagged
- Low-trust11 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is SoulseekQt-2024-6-30.AppImage safe?
What is SoulseekQt-2024-6-30.AppImage?
How many antivirus engines detected SoulseekQt-2024-6-30.AppImage?
What is the SHA-256 hash of SoulseekQt-2024-6-30.AppImage?
Is it safe to open SoulseekQt-2024-6-30.AppImage?
How up to date is this analysis of SoulseekQt-2024-6-30.AppImage?
Community
Member reviews and reports for this exact file hash.