Report - raw.githubusercontent.com/ParrotSec/mimikatz/refs/heads/master/x64/mimikatz.exe

Report Overview

Visitedpublic

2025-04-08 07:35:45

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
raw.githubusercontent.com	35802	2014-02-06	2014-03-01	2025-04-02	547 B	1.3 MB	185.199.110.133

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2025-04-08	medium	raw.githubusercontent.com/ParrotSec/mimikatz/refs/heads/master/x64/mimikatz.exe	mimikatz
2025-04-08	medium	raw.githubusercontent.com/ParrotSec/mimikatz/refs/heads/master/x64/mimikatz.exe	Detects Mimikatz strings
2025-04-08	medium	raw.githubusercontent.com/ParrotSec/mimikatz/refs/heads/master/x64/mimikatz.exe	Detects Mimikatz SkeletonKey in Memory
2025-04-08	medium	raw.githubusercontent.com/ParrotSec/mimikatz/refs/heads/master/x64/mimikatz.exe	Detects mimikatz icon in PE file
2025-04-08	medium	raw.githubusercontent.com/ParrotSec/mimikatz/refs/heads/master/x64/mimikatz.exe	Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible)
2025-04-08	medium	raw.githubusercontent.com/ParrotSec/mimikatz/refs/heads/master/x64/mimikatz.exe	Detects Mimikatz by using some special strings
2025-04-08	medium	raw.githubusercontent.com/ParrotSec/mimikatz/refs/heads/master/x64/mimikatz.exe	Windows.Hacktool.Mimikatz
2025-04-08	medium	raw.githubusercontent.com/ParrotSec/mimikatz/refs/heads/master/x64/mimikatz.exe	Windows.Hacktool.Mimikatz
2025-04-08	medium	raw.githubusercontent.com/ParrotSec/mimikatz/refs/heads/master/x64/mimikatz.exe	Detects win.mimikatz.

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

raw.githubusercontent.com/ParrotSec/mimikatz/refs/heads/master/x64/mimikatz.exe

IP / ASN

185.199.110.133

#54113 FASTLY

File Overview

File TypePE32+ executable (console) x86-64, for MS Windows, 6 sections

Size1.3 MB (1250056 bytes)

MD5e930b05efe23891d19bc354a4209be3e

SHA1d1f7832035c3e8a73cc78afd28cfd7f4cece6d20

SHA25692804faaab2175dc501d73e814663058c78c0a042675a8937266357bcfb96c50

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	mimikatz
Public Nextron YARA rules	malware	Detects Mimikatz strings
Public Nextron YARA rules	malware	Detects Mimikatz SkeletonKey in Memory
Public Nextron YARA rules	malware	Detects mimikatz icon in PE file
Public Nextron YARA rules	malware	Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible)
Public Nextron YARA rules	malware	Detects Mimikatz by using some special strings
Elastic Security YARA Rules	malware	Windows.Hacktool.Mimikatz
Elastic Security YARA Rules	malware	Windows.Hacktool.Mimikatz
Malpedia's yara-signator rules	malware	Detects win.mimikatz.
VirusTotal	malicious	VirusTotal - Scan result 61/70

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET raw.githubusercontent.com/ParrotSec/mimikatz/refs/heads/master/x64/mimikatz.exe

185.199.110.133

200 OK

1.3 MB

URL User Request GET HTTPS

raw.githubusercontent.com/ParrotSec/mimikatz/refs/heads/master/x64/mimikatz.exe

IP / ASN

185.199.110.133

#54113 FASTLY

Requested byN/A

Resource Info

File typePE32+ executable (console) x86-64, for MS Windows, 6 sections

First Seen2023-05-03

Last Seen2025-05-29

Times Seen282

Size1.3 MB (1250056 bytes)

MD5e930b05efe23891d19bc354a4209be3e

SHA1d1f7832035c3e8a73cc78afd28cfd7f4cece6d20

SHA25692804faaab2175dc501d73e814663058c78c0a042675a8937266357bcfb96c50

Certificate Info

IssuerSectigo Limited

Subject*.github.io

Fingerprint8C:FF:59:E5:8E:C4:FA:76:FE:AF:2D:C5:C0:D4:13:6A:77:2D:F9:91

ValidityFri, 07 Mar 2025 00:00:00 GMT - Sat, 07 Mar 2026 23:59:59 GMT

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	mimikatz
Public Nextron YARA rules	malware	Detects Mimikatz strings
Public Nextron YARA rules	malware	Detects Mimikatz SkeletonKey in Memory
Public Nextron YARA rules	malware	Detects mimikatz icon in PE file
Public Nextron YARA rules	malware	Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible)
Public Nextron YARA rules	malware	Detects Mimikatz by using some special strings
Elastic Security YARA Rules	malware	Windows.Hacktool.Mimikatz
Elastic Security YARA Rules	malware	Windows.Hacktool.Mimikatz
Malpedia's yara-signator rules	malware	Detects win.mimikatz.
VirusTotal	malicious	VirusTotal - Scan result 61/70

HTTP Headers

GET /ParrotSec/mimikatz/refs/heads/master/x64/mimikatz.exe HTTP/1.1
Host: raw.githubusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: max-age=300
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
content-type: application/octet-stream
etag: W/"44150c3a20339a2261a3fa789e33be1bd914c8d549eaade9075562e04fc955ab"
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 1; mode=block
x-github-request-id: 861F:933B5:9520C2:A65868:67F4D1BA
accept-ranges: bytes
date: Tue, 08 Apr 2025 07:35:23 GMT
via: 1.1 varnish
x-served-by: cache-hel1410030-HEL
x-cache: MISS
x-cache-hits: 0
x-timer: S1744097724.520126,VS0,VE256
vary: Authorization,Accept-Encoding,Origin
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-fastly-request-id: 2c009716884837d30e51a18033a0877fe47461d4
expires: Tue, 08 Apr 2025 07:40:23 GMT
source-age: 0
content-length: 1250056
X-Firefox-Spdy: h2