GET github.com/AlessandroZ/LaZagne/releases/download/v2.4.7/lazagne.exe
302 Found 10 MB URL User Request GET github.com/AlessandroZ/LaZagne/releases/download/v2.4.7/lazagne.exe
IP
Certificate IssuerSectigo Limited
Subjectgithub.com
FingerprintE4:33:71:DD:D6:91:4A:75:B6:1F:9E:4F:74:6D:9B:F0:DD:26:FC:3A
ValidityWed, 05 Feb 2025 00:00:00 GMT - Thu, 05 Feb 2026 23:59:59 GMT
Size 10 MB (10136093 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /AlessandroZ/LaZagne/releases/download/v2.4.7/lazagne.exe HTTP/1.1
Host: github.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Tue, 15 Apr 2025 14:39:02 GMT
content-type: text/html; charset=utf-8
content-length: 0
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame,Accept-Encoding, Accept, X-Requested-With
location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/30870954/1e7fa45c-7ef9-4b6d-ac70-345060d135ad?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250415%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250415T143902Z&X-Amz-Expires=300&X-Amz-Signature=768085b05b41f636d654f95b4fb50a9378008ba24a84b60105eac75c948b45e9&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DLaZagne.exe&response-content-type=application%2Foctet-stream
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
server: github.com
x-github-request-id: 1EF1:109A7F:4C7C3A:4DF4CB:67FE6F86
X-Firefox-Spdy: h2
GET objects.githubusercontent.com/github-production-release-asset-2e65be/30870954/1e7fa45c-7ef9-4b6d-ac70-345060d135ad?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250415%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250415T143902Z&X-Amz-Expires=300&X-Amz-Signature=768085b05b41f636d654f95b4fb50a9378008ba24a84b60105eac75c948b45e9&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DLaZagne.exe&response-content-type=application%2Foctet-stream
200 OK 10 MB URL User Request GET objects.githubusercontent.com/github-production-release-asset-2e65be/30870954/1e7fa45c-7ef9-4b6d-ac70-345060d135ad?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250415%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250415T143902Z&X-Amz-Expires=300&X-Amz-Signature=768085b05b41f636d654f95b4fb50a9378008ba24a84b60105eac75c948b45e9&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DLaZagne.exe&response-content-type=application%2Foctet-stream
IP
Certificate IssuerSectigo Limited
Subject*.github.io
Fingerprint8C:FF:59:E5:8E:C4:FA:76:FE:AF:2D:C5:C0:D4:13:6A:77:2D:F9:91
ValidityFri, 07 Mar 2025 00:00:00 GMT - Sat, 07 Mar 2026 23:59:59 GMT
File type PE32+ executable (console) x86-64, for MS Windows, 6 sections
Size 10 MB (10136093 bytes)
Hash 81448745b5d62608b37888b38e9f276a
3197ad76e27ca63e6de1b255f7c0196ea7670bf8
dc06d62ee95062e714f2566c95b8edaabfd387023b1bf98a09078b84007d5268
Analyzer Verdict Alert Public Nextron YARA rules malware Detects Lazagne password extractor hacktool
Public InfoSec YARA rules malware Identifies LaZagne, credentials recovery project.
Public InfoSec YARA rules malware Identifies executable converted using PyInstaller.
VirusTotal malicious
GET /github-production-release-asset-2e65be/30870954/1e7fa45c-7ef9-4b6d-ac70-345060d135ad?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250415%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250415T143902Z&X-Amz-Expires=300&X-Amz-Signature=768085b05b41f636d654f95b4fb50a9378008ba24a84b60105eac75c948b45e9&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DLaZagne.exe&response-content-type=application%2Foctet-stream HTTP/1.1
Host: objects.githubusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/octet-stream
last-modified: Thu, 10 Apr 2025 14:15:00 GMT
etag: "0x8DD783A147B64A6"
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 04be43cb-201e-005f-2823-aa5569000000
x-ms-version: 2025-01-05
x-ms-creation-time: Thu, 10 Apr 2025 14:15:00 GMT
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
content-disposition: attachment; filename=LaZagne.exe
x-ms-server-encrypted: true
via: 1.1 varnish, 1.1 varnish
fastly-restarts: 1
accept-ranges: bytes
age: 3295
date: Tue, 15 Apr 2025 14:39:02 GMT
x-served-by: cache-iad-kjyo7100178-IAD, cache-hel1410025-HEL
x-cache: HIT, HIT
x-cache-hits: 447, 0
x-timer: S1744727942.414839,VS0,VE101
content-length: 10136093
X-Firefox-Spdy: h2
140.82.121.4
185.199.108.133