Suspicious
Suspect

489f834f5f6ed0e120828bebf397c811

GZIP Archive
MD5: 489f834f5f6ed0e120828bebf397c811
Size: 3.25 MB
application/gzip

This sample is a 3.1 MB GZIP Archive for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 15 embedded or derived files. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
2b96e1fefa7210da37cebff57e10c76139f6953f908c819296a48ddf5eada707
MD5
489f834f5f6ed0e120828bebf397c811
Verdict
Inconclusive
File type
GZIP Archive · 3.1 MB

Cite this report: https://app.malva.re/sha256/2b96e1fefa7210da37cebff57e10c76139f6953f908c819296a48ddf5eada707

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
GZIP archive
Size
3.25 MB · 3,245,415 B
First seen
2026-07-26 14:16 · 3 months ago
Last seen
2026-07-26 14:16 · 3 months ago
Last analysis
2026-07-26 15:31 · 3 months ago
Hashes
MD5 489f834f5f6ed0e120828bebf397c811 Sha1 e4c2ac1a60b8079da005dda025304749ebaf7217 Sha256 2b96e1fefa7210da37cebff57e10c76139f6953f908c819296a48ddf5eada707 Sha384 17705e9612fa1831adc5457380af8f27687d5aaeb4e50244d76bea13444f391dfc9abf1a2a1e7576db678e5dd94f9a3e Sha512 a978121922911f81da2176aa66775ab9f5341bd6f43f2a9502c7962f21f91fc2cfa86b3105bd88dcd526cda1636b4281b95b3f57164b2fb98f589b14f7dd0ee8 SSDeep 98304:p46bISNpJ877CnosVBVibRTZQiVhF/wAEs7:p46bISt8vCntVoR1Quz/wAEs7 TLSH 7CE5332545B32C7F16BFF7D4BAB1AD41A9D0562C5CB248373B79B14E08B2BE30C69246

16 files
GZ489f834f5f6ed0e120828bebf397c811
TARfile_0.bin
BINpayload
BINd41d8cd98f00b204e9800998ecf8427e
SHdoit.sh
BINbin
ELFdropbearkey
ELFssh
ELFdropbear
ELFssh-keygen
BINlib
ELFlibz.so.1
ELFlibskarnet.so.2.15
ELFld-musl-x86_64.so.1
ELFlibcrypto.so.3
ELFlibutmps.so.0.1
BINetc
BINconfig
BINkeys
BINauthorized_keys
BINtunnel_key
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:gz>arc:tar>elf
Shape arc:gz>arc:tar>elf
3 nodes

16 files
GZ489f834f5f6ed0e120828bebf397c811
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙