File scan report
Verdict Safe
Is Whitedust_
Clean ZIP archive containing a user theme with zero malicious detections and benign sandbox behaviour.
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
The file can be considered safe for normal use as a device theme archive.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 64 flagged
- Flagged 0
- No detection 64
- No result 12
- Code signing Not applicable
- Test run Completed
- First seen 1y ago
Chapter 02
Why we think so
0 points against it and 2 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Sandbox analysis shows only routine archive handling with no malicious network activity or dropped files. The file matches the expected profile of a HyperOS/MIUI theme package.
Zero engine detections combined with clean major consensus and no sandbox malice provide high confidence the archive is benign. The single offensive MITRE technique is explained by the sandbox's own process monitoring rather than malicious intent. Age and low submission count are typical for niche customization files rather than widespread malware.
What We Detected
ZIP archive first seen on Aug 12, 2025. No antivirus engine flagged the sample. Sandbox observed standard archive extraction commands and system logging rotation unrelated to the file itself.
Threat Behavior
No network contacts, no dropped executables, no persistence mechanisms created by the sample. The T1543.002 technique trace originates from sandbox tooling, not the archive contents.
What To Do Now
Safe to open with a standard archive manager. Verify contents manually if obtained from an untrusted source.
Where this verdict could be wrong1 caveat
- appears in sandbox processes but is likely an artifact of the analysis environment opening the archive rather than actual persistence creation.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No malicious sandbox verdict or host contacts
- Long observation window with no reputation issues
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 4sandbox rule tags
- 6spawned processes
- 0network contacts
- 1filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
4MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1064
- T1518.001· Checks your AV
- T1543.002· Service install
- T1564.001· Hides artifacts
Observed activity
Processes started
6Programs the file ran, with their command lines.
exo-open/usr/bin/exo-open exo-open /tmp/Whitedust_HyperOSThemes.com.mtzexo-open/usr/bin/exo-open -engrampa/usr/bin/engrampa engrampa /tmp/Whitedust_HyperOSThemes.com.mtz7z/usr/lib/p7zip/7z l -slt -bd -y -- /tmp/Whitedust_HyperOSThemes.com.mtzxfce4-screensaver-gl-helper/usr/libexec/xfce4-screensaver-gl-helperpython3.8/usr/bin/python3.8 -
Files
1Files the file created, changed or deleted.
- Written
/root/.cache/dconf/user
Sandbox background — not the file
6The analysis machine's own processes and connections, recorded in every run.
- VM process
dbus-launch/usr/bin/dbus-launch dbus-launch --autolaunch=a39eb3ed78b7401fb6809ed0c562a5b1 --binary-syntax --close-stderr - VM process
sh/bin/sh sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog - VM process
rsyslog-rotate/usr/lib/rsyslog/rsyslog-rotate - VM process
systemctl/usr/bin/systemctl systemctl kill -s HUP rsyslog.service - VM process
gzip/bin/gzip - VM process
sh/bin/sh sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/mail.info/var/log/mail.warn/var/log/mail.err/var/log/mail.log/var/log/daemon.log/var/log/kern.log/var/log/auth.log/var/log/user.log/var/log/lpr.log/var/log/cron.log/var/log/debug/var/log/messages
Chapter 04
Technical details
None of the 64 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- May 17, 2026, 1:28 PM UTC
- SHA-256
bd4063c1beec640e0556e3516531676cab68cb039917b8cff16554333916cb8b- SHA-1
caf36bdc1c223fe2da54c8c12f0cc37fd9b43344- MD5
21276be44e382440d0722f8fc366a8a2
About this file
Whitedust_miuithemer.com.mtz.zip is a ZIP file of 12.7 MB.
- Type and size
- ZIP · 12.7 MB
- Signer
- Not applicable
- First seen
- Aug 12, 2025On VirusTotal.
- Submitted by
- 3 distinct sourcesRarely seen: few people have submitted this exact file.
First scanned
Antivirus consensus
0 of 64 engines flagged this file
12 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-233 engines0flagged
- Low-trust13 engines0flagged
View all 76 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Whitedust_miuithemer.com.mtz.zip safe?
What is Whitedust_miuithemer.com.mtz.zip?
How many antivirus engines detected Whitedust_miuithemer.com.mtz.zip?
What is the SHA-256 hash of Whitedust_miuithemer.com.mtz.zip?
Is it safe to open or extract Whitedust_miuithemer.com.mtz.zip?
How up to date is this analysis of Whitedust_miuithemer.com.mtz.zip?
Community
Member reviews and reports for this exact file hash.