File scan report
Verdict Safe
Is Athelas-
Only 1 of the 64 antivirus engines that checked it flagged this archive with a generic less reliable label, while higher-trust engines and completed sandbox runs found no…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 64 flagged
- Flagged 1
- No detection 63
- No result 11
- Code signing Not applicable
- Test run Completed
- First seen 6d ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The lone Bkav detection is most consistent with a false positive: none of the higher-trust engines flagged the archive, and sandbox execution produced no malicious verdict or high-risk behavior. Because the file is and our static inspection was unavailable, obtaining it from its official source remains advisable.
Higher-trust engines including BitDefender, ESET, Kaspersky, and Fortinet did not flag it, leaving no independent antivirus corroboration. Two completed sandbox runs produced no malicious verdict, identified no high-risk techniques, and recorded neither process injection nor sample network activity. Public malware databases, malware-specific community rules, and inspected file it created results supplied no hostile corroboration. The file is and our static analysis plus a complete host-reputation check are unavailable, so confidence is strong but not absolute.
What We Detected
Only 1 of the 64 antivirus engines that checked it flagged the archive. The detection came from Bkav and used a generic malware label; higher-trust engines such as BitDefender, ESET, Kaspersky, and Fortinet did not flag it.
Threat Behavior
Two completed sandbox runs returned no malicious verdict. They showed no high-risk techniques, process injection, persistence indicators, or sample network contacts. No malware-specific community rules, public malware-database listing, or malicious file it created result corroborated the lone detection. A complete contacted-host reputation result was not available.
What To Do Now
The evidence strongly favors an isolated false positive. Since the archive is and our static inspection was unavailable, download it only from the developer's official release channel, keep security software enabled, and verify any publisher-provided checksum before opening it.
Where this verdict could be wrong3 caveats
- Bkav produced a generic malware detection, although no other engine corroborated it.
- The archive has only one recorded submitter and was first observed on Oct 20, 2026, so it lacks established prevalence.
- Our static analysis was not available, and no complete contacted-host reputation result was saved.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the higher-trust engines flagged the archive.
- Two completed sandbox runs produced no malicious verdict or high-risk behavior.
- No process injection, persistence activity, or sample network contact was recorded.
- No public malware-database or malware-specific community-rule match was found.
- No inspected file it created had a malicious result.
- Bkav alone reported a generic malware label.
- The archive was first observed on Oct 20, 2026 and has one recorded submitter.
- Our own static inspection was unavailable.
- A complete reputation check for contacted hosts was not saved.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 2 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 2isolated sandbox runs
- 5sandbox rule tags
- 4spawned processes
- 0network contacts
- 5filesystem & mutex artifacts
What this file did when executed
This file was detonated in 2 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
5MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1064
- T1071· Application protocol
- T1518.001· Checks your AV
- T1543.002· Service install
- T1564.001· Hides artifacts
Observed activity
Processes started
4Programs the file ran, with their command lines.
exo-open/usr/bin/exo-open exo-open /tmp/Athelas-1.1.3-arm64.zipexo-open/usr/bin/exo-open -engrampa/usr/bin/engrampa engrampa /tmp/Athelas-1.1.3-arm64.zip7z/usr/lib/p7zip/7z l -slt -bd -y -- /tmp/Athelas-1.1.3-arm64.zip
Files
5Files the file created, changed or deleted.
- Written
/root/.cache/dconf/user - Written
/var/log/auth.log.1.gz - Written
/var/log/dpkg.log.1.gz - Written
/var/log/kern.log.1.gz - Written
/var/log/syslog.1.gz
Sandbox background — not the file
11The analysis machine's own processes and connections, recorded in every run.
- VM process
dbus-launch/usr/bin/dbus-launch dbus-launch --autolaunch=a39eb3ed78b7401fb6809ed0c562a5b1 --binary-syntax --close-stderr - VM process
gzip/bin/gzip - VM process
sh/bin/sh sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log " - VM process
invoke-rc.d/usr/sbin/invoke-rc.d invoke-rc.d --quiet cups restart - VM process
runlevel/sbin/runlevel - VM process
systemctl/usr/bin/systemctl systemctl --quiet is-enabled cups.service
Show all 11 entries for sandbox background — not the file
- VM process
ls/usr/bin/ls ls /etc/rc[S2345].d/S[0-9][0-9]cups - VM process
systemctl/usr/bin/systemctl systemctl --quiet is-active cups.service - VM process
sh/bin/sh sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog - VM process
rsyslog-rotate/usr/lib/rsyslog/rsyslog-rotate - VM process
systemctl/usr/bin/systemctl systemctl kill -s HUP rsyslog.service
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- a24e199dbf02a6174b24…96e786Not checkedno saved verdict
- 34191cc73dbf761f2688…d3be4bNot checkedno saved verdict
- be6208a6dbf59d8fd14e…383c57Not checkedno saved verdict
- 38c64f347fa47b7144a0…953523Not checkedno saved verdict
- 28061ec6fa13060675be…a54c93Not checkedno saved verdict
- 5c6d458933f8ebeff011…1d40c1Not checkedno saved verdict
- 6055bf89f2c6dabf6c8e…12d287Not checkedno saved verdict
- 9152ba43386e756790a6…2fc364Not checkedno saved verdict
- 265888c31ca78dffa290…1497faNot checkedno saved verdict
- 19b4d705f1402ef89ce7…aa2f0cNot checkedno saved verdict
Chapter 04
Technical details
1 of the 64 antivirus engines that checked it flags it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- BkavW32.Malware.5E24E27B
File fingerprint
- Last analyzed
- Oct 20, 2026, 11:17 PM UTC
- SHA-256
0722277b05f914365ad43ad08daa5538be05d38951303a87717194d582df99ee- SHA-1
98c03f2269587976f86693af1fad577bbfd45755- MD5
ddf9f4fc63c5ea5ed0611d952785ee91
About this file
Athelas-1.1.3-arm64.zip is a ZIP file of 32.6 MB.
- Type and size
- ZIP · 32.6 MB
- Signer
- Not applicable
- First seen
- Oct 20, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned
Antivirus consensus
1 of 64 engines flagged this file
11 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-234 engines0flagged
- Low-trust12 engines1flagged
View all 75 engine results
- BkavMalicious: W32.Malware.5E24E27B
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureNo result
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforNo result
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Barely seen in the wild and first surfaced recently. 1 antivirus detection make that low prevalence materially relevant, but rarity alone is not proof of malware.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Athelas-1.1.3-arm64.zip safe?
What is Athelas-1.1.3-arm64.zip?
How many antivirus engines detected Athelas-1.1.3-arm64.zip?
What is the SHA-256 hash of Athelas-1.1.3-arm64.zip?
Is it safe to open or extract Athelas-1.1.3-arm64.zip?
How up to date is this analysis of Athelas-1.1.3-arm64.zip?
Community
Member reviews and reports for this exact file hash.