Suspicious
Suspect

dd935a44725605b4df792ecc99c30630

GZIP Archive
MD5: dd935a44725605b4df792ecc99c30630
Size: 15.11 MB
application/gzip

This sample is a 14.4 MB GZIP Archive for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 4 embedded or derived files. It matches 4 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
b24813aa304464c2463d52dc2d2da13774bb44ddd6bfe3fb4d6c9dabf1948e9b
MD5
dd935a44725605b4df792ecc99c30630
Verdict
Inconclusive
File type
GZIP Archive · 14.4 MB

Cite this report: https://app.malva.re/sha256/b24813aa304464c2463d52dc2d2da13774bb44ddd6bfe3fb4d6c9dabf1948e9b

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
GZIP archive
Size
15.11 MB · 15,114,135 B
First seen
2026-08-05 19:01 · 2 months ago
Last seen
2026-08-05 19:01 · 2 months ago
Last analysis
2026-08-05 21:30 · 2 months ago
Hashes
MD5 dd935a44725605b4df792ecc99c30630 Sha1 5878d2a5b4b50fa1ee03e1479fb45bb6a9ed8659 Sha256 b24813aa304464c2463d52dc2d2da13774bb44ddd6bfe3fb4d6c9dabf1948e9b Sha384 05d27246539e2d93fcf2fe5b1ee683f7a74b6488c94932718fa1ff0fd6bcdf6e7283f56ad71eecab475977e1e458ddb3 Sha512 001e5a6e28835c77bfa4cf3bd602d708079275e6a3ad221bd24bce47e5e7c0f030222e73560bbe5eef385d1cc6b65ed767161301cb00183ece7ad8e8a2ee8440 SSDeep 393216:CUWoecenr4O2n22/n4fG0WlXUu+pjhYqCujS5sqR+KmU:CToejMO2n26nUG02XUpmsK+KL TLSH 20E633A1A7491C46F66FE720BD131CE57AEA306A8E8274C22603505F2FDF5C8435DDEA

5 files
GZdd935a44725605b4df792ecc99c30630
TARfile_0.bin
BINwhitedns_v1.4.2_linux-amd64
BINd41d8cd98f00b204e9800998ecf8427e
MDREADME.md
ELFwhitedns
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:gz>arc:tar>elf
Shape arc:gz>arc:tar>elf
3 nodes

5 files
GZdd935a44725605b4df792ecc99c30630
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙