Report - github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz

Report Overview

Visited public
2025-05-06 01:31:03
Tags
URL
github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.zip
Finishing URL
about:privatebrowsing
IP / ASN
140.82.121.3
#36459 GITHUB
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
github.com	1423	unknown	No data	No data	550 B	1.2 MB	140.82.121.3
objects.githubusercontent.com	134060	unknown	No data	No data	974 B	1.2 MB	185.199.110.133

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
objects.githubusercontent.com/github-production-release-asset-2e65be/18496166/28e3acb5-ca66-40d5-bc68-f76f5bfabecf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250506%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250506T013030Z&X-Amz-Expires=300&X-Amz-Signature=f0130ca690aae9914200f938b2fa35bde782c458dc84ac7160807ba7e8225243&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dmimikatz_trunk.zip&response-content-type=application%2Foctet-stream
IP
185.199.110.133
ASN
#54113 FASTLY

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
1.2 MB (1206166 bytes)
Hash
d2d3e1f8023b12fb89e400c7e8ecd7db
4112ef95386ea4d1131be7c600d49a310e9d8f5b
7accd179e8a6b2fc907e7e8d087c52a7f48084852724b03d25bebcada1acbca5

Archive (12)

Filename

Md5

File type

kiwi_passwords.yar

21cb5b54ab42c19f66a10e839f789d64

ASCII text, with CRLF line terminators

mimicom.idl

ca47e27329203c266372d04475db2c57

ASCII text, with CRLF line terminators

README.md

389833fb7cb7ceb525e914f0f36f2d40

ASCII text

mimidrv.sys

0818699d065afcb1f397d578d3708dc2

PE32 executable (native) Intel 80386, for MS Windows, 7 sections

mimikatz.exe

d3b17ddf0b98fd2441ed46b033043456

PE32 executable (console) Intel 80386, for MS Windows, 5 sections

mimilib.dll

46e598798bdde4c72e796edcf2317b52

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 5 sections

mimilove.exe

c67f3497c310c01018f599b3eebae99e

PE32 executable (console) Intel 80386, for MS Windows, 5 sections

mimispool.dll

dab7a18b02399053ba3ff1e568789fce

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 5 sections

mimidrv.sys

3e528207ca374123f63789195a4aedde

PE32+ executable (native) x86-64, for MS Windows, 8 sections

mimikatz.exe

29efd64dd3c7fe1e2b022b7ad73a1ba5

PE32+ executable (console) x86-64, for MS Windows, 6 sections

mimilib.dll

67651e9d2da634adedbe216948d5f752

PE32+ executable (DLL) (console) x86-64, for MS Windows, 6 sections

mimispool.dll

c6cc0def7d584f431d69126c1cc33a20

PE32+ executable (DLL) (console) x86-64, for MS Windows, 6 sections

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	PowerShell with PE Reflective Injection
Public Nextron YARA rules	malware	Detects strings found in Runspace Post Exploitation Toolkit
Public Nextron YARA rules	malware	mimikatz
Public Nextron YARA rules	malware	Detects Mimikatz strings
Elastic Security YARA Rules	malware	Windows.Hacktool.Mimikatz
Public Nextron YARA rules	malware	mimikatz
Public Nextron YARA rules	malware	Detects Mimikatz strings
Public Nextron YARA rules	malware	Detects mimikatz icon in PE file
Public Nextron YARA rules	malware	Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible)
Public Nextron YARA rules	malware	Detects Mimikatz by using some special strings
YARAhub by abuse.ch	malware	meth_stackstrings
Elastic Security YARA Rules	malware	Windows.Hacktool.Mimikatz
Public Nextron YARA rules	malware	Detects Mimikatz strings
Public Nextron YARA rules	malware	mimikatz
Public Nextron YARA rules	malware	Detects Mimikatz strings
Elastic Security YARA Rules	malware	Windows.Hacktool.Mimikatz
Public Nextron YARA rules	malware	mimikatz
Public Nextron YARA rules	malware	Detects Mimikatz strings
Public Nextron YARA rules	malware	Detects Mimikatz SkeletonKey in Memory
Public Nextron YARA rules	malware	Detects mimikatz icon in PE file
Public Nextron YARA rules	malware	Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible)
Public Nextron YARA rules	malware	Detects Mimikatz by using some special strings
Elastic Security YARA Rules	malware	Windows.Hacktool.Mimikatz
Elastic Security YARA Rules	malware	Windows.Hacktool.Mimikatz
Malpedia's yara-signator rules	malware	Detects win.mimikatz.
Public Nextron YARA rules	malware	Detects Mimikatz strings
VirusTotal	malicious	VirusTotal - Scan result 58/66

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.zip

140.82.121.3

302 Found

1.2 MB

URL User Request GET
github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.zip
IP
140.82.121.3:443
ASN
#36459 GITHUB

Certificate
IssuerSectigo Limited
Subjectgithub.com
FingerprintE4:33:71:DD:D6:91:4A:75:B6:1F:9E:4F:74:6D:9B:F0:DD:26:FC:3A
ValidityWed, 05 Feb 2025 00:00:00 GMT - Thu, 05 Feb 2026 23:59:59 GMT

File type

Size
1.2 MB (1206166 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.zip HTTP/1.1
Host: github.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Tue, 06 May 2025 01:30:30 GMT
content-type: text/html; charset=utf-8
content-length: 0
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame,Accept-Encoding, Accept, X-Requested-With
location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/18496166/28e3acb5-ca66-40d5-bc68-f76f5bfabecf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250506%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250506T013030Z&X-Amz-Expires=300&X-Amz-Signature=f0130ca690aae9914200f938b2fa35bde782c458dc84ac7160807ba7e8225243&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dmimikatz_trunk.zip&response-content-type=application%2Foctet-stream
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
server: github.com
x-github-request-id: 51C7:76300:1950F55:1A260CC:68196636
X-Firefox-Spdy: h2

objects.githubusercontent.com/github-production-release-asset-2e65be/18496166/28e3acb5-ca66-40d5-bc68-f76f5bfabecf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250506%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250506T013030Z&X-Amz-Expires=300&X-Amz-Signature=f0130ca690aae9914200f938b2fa35bde782c458dc84ac7160807ba7e8225243&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dmimikatz_trunk.zip&response-content-type=application%2Foctet-stream

185.199.110.133

200 OK

1.2 MB

URL User Request GET
objects.githubusercontent.com/github-production-release-asset-2e65be/18496166/28e3acb5-ca66-40d5-bc68-f76f5bfabecf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250506%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250506T013030Z&X-Amz-Expires=300&X-Amz-Signature=f0130ca690aae9914200f938b2fa35bde782c458dc84ac7160807ba7e8225243&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dmimikatz_trunk.zip&response-content-type=application%2Foctet-stream
IP
185.199.110.133:443
ASN
#54113 FASTLY

Certificate
IssuerSectigo Limited
Subject*.github.io
Fingerprint8C:FF:59:E5:8E:C4:FA:76:FE:AF:2D:C5:C0:D4:13:6A:77:2D:F9:91
ValidityFri, 07 Mar 2025 00:00:00 GMT - Sat, 07 Mar 2026 23:59:59 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
1.2 MB (1206166 bytes)
Hash
d2d3e1f8023b12fb89e400c7e8ecd7db
4112ef95386ea4d1131be7c600d49a310e9d8f5b
7accd179e8a6b2fc907e7e8d087c52a7f48084852724b03d25bebcada1acbca5

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 58/66

HTTP Headers

GET /github-production-release-asset-2e65be/18496166/28e3acb5-ca66-40d5-bc68-f76f5bfabecf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250506%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250506T013030Z&X-Amz-Expires=300&X-Amz-Signature=f0130ca690aae9914200f938b2fa35bde782c458dc84ac7160807ba7e8225243&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dmimikatz_trunk.zip&response-content-type=application%2Foctet-stream HTTP/1.1
Host: objects.githubusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/octet-stream
last-modified: Mon, 19 Sep 2022 15:54:21 GMT
etag: "0x8DA9A57378064D0"
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 04acd6d7-f01e-003e-5765-b6762a000000
x-ms-version: 2025-01-05
x-ms-creation-time: Mon, 19 Sep 2022 15:54:21 GMT
x-ms-blob-content-md5: 0tPh+AI7EvuJ5ADH6OzX2w==
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
content-disposition: attachment; filename=mimikatz_trunk.zip
x-ms-server-encrypted: true
via: 1.1 varnish, 1.1 varnish
fastly-restarts: 1
accept-ranges: bytes
age: 828
date: Tue, 06 May 2025 01:30:31 GMT
x-served-by: cache-iad-kjyo7100034-IAD, cache-hel1410025-HEL
x-cache: HIT, HIT
x-cache-hits: 1779, 0
x-timer: S1746495031.792845,VS0,VE97
content-length: 1206166
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (12)

Detections

JavaScript (0)

HTTP Transactions (2)

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers