depumped — OpenCTI Umbrella Label
Overview
depumped (also rendered de-pumped) is an OpenCTI umbrella label covering at least 19 binaries of diverse formats. It carries no independent technical fingerprint. Samples tagged with this label that have been statically analyzed in this corpus resolve to the unclassified-autoit-compiled AutoItSC single-file PE32 cluster.
Observed Mappings
| OpenCTI label | Actual technical family | Sample(s) |
|---|---|---|
de-pumped / depumped |
unclassified-autoit-compiled | 6cc26f7c (UPX-packed shipping lure) ^[/intel/analyses/6cc26f7c50c9d2a309cb6de2059976acf46d3c50930a9e72e9d260c432b28f54.html] |
de-pumped / depumped |
unclassified-autoit-compiled | 1d0834e7 (plain Greek invoice lure) ^[/intel/analyses/1d0834e7d4fe46aa143359a35c69bebc449fc1b1799af77eb96a4cbe320b6884.html] |
Recommendation
Do not create detection rules or hunting queries based on the depumped label alone. Reference the underlying technical family (unclassified-autoit-compiled) for actionable signatures.
Related Entities
- unclassified-autoit-compiled — The actual AutoItSC single-file PE32 cluster.
- autoit-compiled-script-dropper — Concept page covering both single-file and two-file AutoIt deployment patterns.