depumped
Contested OpenCTI umbrella label. Applied to multiple unrelated families (Go infostealers, AutoIt droppers, .NET downloaders) based on behavioral surface similarity. Should be resolved to concrete family attribution whenever possible.
Known Resolutions
- Go 1.25.4 PE32 with randomized
main.*functions → acrstealer (e.g., cf018bde) - AutoIt-compiled scripts → unclassified-autoit-compiled