CatGatekeeper_x64.7z
- SHA256 537c58eac95934e793a1aeac46b8ea7435dabd5a3af312d426e24789064cfce2
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CatGatekeeper_x64.exe
Resource
win11-20260130-en
windows11-21h2-x64
37 signatures
900 seconds
General
- Target CatGatekeeper_x64.7z
- Size 117.3MB
- Sample260502-t7p7jsct4x
- SHA256 537c58eac95934e793a1aeac46b8ea7435dabd5a3af312d426e24789064cfce2
- MD5 d220e3147e7188755f8a9792b82b2b9a
- SHA1 2425604d457e257dfac49461ce5132e53627e406
- SHA512 069c1b04277b2ba6873b8194678c9d08416e1a0c75c1b1e1e0702ae37b8e2834be4b9362446089e9a44b9371e00e6440e908d3bce5252dec6e95546ee892eed2
- SSDEEP 3145728:xJPycomiGiBCjmd/1LgiMBEUJztqeRXB1uyyl910:xNiGiBl/18DWUBM21Ny72
- TLSH T1084833929080E3225C5FF92A98A3D2A97D9630FE443EC3377457D65680BDFE19B36342
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/CatGatekeeper_x64.exe
File Explorer
-
CatGatekeeper_x64.7z.7z 117.3MB
-
CatGatekeeper_x64.exe.exe 128.1MB
CatGatekeeper_x64.exe
- IMPHASH d3c050ef888f06ae00a6ef5f1f579381
- SHA256 8fc8ae7284f5baf76367737930cf4b6584429f49a6b8b6f87c4f5550ce925d51
- MD5 86c7f2a3c307928daaca7c1df3ea5d72
- SHA1 9b4a7c860be8d7b6285eadb1dce0ae3d33321fa1
- SHA512 8b900b88a77314f1c0cafa3cd2d7641694e9312b6ffc3dfd27e64d971de1abac55225ec5e4e28471957256cc5bf21e37386e6df48b4d82647bec193f36e699a3
- SSDEEP 1572864:Nf/qxhps4S35tNDBGCj8qeulLcd0crL1pwR7Jk1+3XGKXKdw+EyIUeSLAsRFFh26:Yxh+V0ere280tXmKywByIY3RFF6+FW
- TLSH T16F582301BA5A9524D05EC87492434B934F2170EB063BE4FF91D945283FABBF49B3E35A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6117792
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ClawCode.pdb
kernel32
GetConsoleMode
GetStdHandle
LoadLibraryA
GetTempPathW
GetProcessHeap
HeapFree
HeapAlloc
GetModuleHandleW
Sleep
GetModuleHandleA
SetHandleInformation
WriteFileEx
GetFileInformationByHandle
ReadFileEx
CancelIo
GetOverlappedResult
FormatMessageW
LoadLibraryExA
ReadFile
DeleteFileW
SetFileInformationByHandle
GetFileInformationByHandleEx
GetConsoleWindow
GetSystemDirectoryW
GetWindowsDirectoryW
GetFileAttributesW
FreeConsole
SetFilePointerEx
SetLastError
GetSystemInfo
CloseHandle
GetModuleFileNameW
GetPhysicallyInstalledSystemMemory
CreateFileW
GetTickCount64
FindNextFileW
PostQueuedCompletionStatus
LoadLibraryExW
HeapReAlloc
SetFileCompletionNotificationModes
GlobalSize
CreateIoCompletionPort
GetQueuedCompletionStatusEx
GetFinalPathNameByHandleW
FlushFileBuffers
HeapSize
GetLastError
FindClose
UnmapViewOfFile
VirtualProtect
DuplicateHandle
MapViewOfFile
CreateFileMappingW
GlobalAlloc
GlobalFree
GlobalUnlock
GlobalLock
GetSystemTimePreciseAsFileTime
GetFileType
SetStdHandle
WriteFile
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleExW
WriteConsoleW
GetConsoleOutputCP
FreeLibrary
CreateDirectoryW
GetFullPathNameW
GetDiskFreeSpaceExW
FindFirstFileExW
SetThreadErrorMode
SetFileTime
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
TerminateProcess
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
EncodePointer
GetACP
FlsSetValue
FlsGetValue
FlsAlloc
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetStartupInfoW
SetUnhandledExceptionFilter
InitializeSListHead
GetOEMCP
GetCPInfo
IsValidCodePage
SetEnvironmentVariableW
GetStringTypeW
CompareStringW
LCMapStringW
FlsFree
RemoveVectoredExceptionHandler
CreateEventA
GetExitCodeProcess
WaitForMultipleObjects
FreeEnvironmentStringsW
GetEnvironmentStringsW
CreateProcessW
CompareStringOrdinal
CreateEventW
ExitProcess
QueryPerformanceCounter
SleepEx
CreateThread
QueryPerformanceFrequency
GetCommandLineW
GetEnvironmentVariableW
MultiByteToWideChar
WaitForSingleObject
ReleaseMutex
CreateMutexA
GetCurrentProcessId
lstrlenW
WaitForSingleObjectEx
GetCurrentDirectoryW
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetUserPreferredUILanguages
WideCharToMultiByte
GetCurrentThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
Process32Next
Process32First
CreateToolhelp32Snapshot
SwitchToThread
GetCurrentProcess
SetWaitableTimer
CreateWaitableTimerExW
GetCurrentThreadId
advapi32
RegQueryValueExW
RevertToSelf
ImpersonateAnonymousToken
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
SystemFunction036
GetTokenInformation
OpenProcessToken
oleaut32
SysStringLen
GetErrorInfo
SysFreeString
ntdll
NtWriteFile
NtReadFile
NtCreateFile
NtDeviceIoControlFile
NtCancelIoFileEx
NtOpenFile
RtlNtStatusToDosError
NtCreateNamedPipeFile
ws2_32
WSASocketW
WSASend
connect
getsockopt
shutdown
recv
setsockopt
bind
closesocket
WSAIoctl
WSAStartup
WSACleanup
getaddrinfo
getsockname
freeaddrinfo
send
getpeername
ioctlsocket
WSAGetLastError
bcrypt
BCryptGenRandom
crypt32
CertAddCertificateContextToStore
CertGetCertificateChain
CertFreeCertificateChain
CertDuplicateCertificateContext
CertDuplicateCertificateChain
CertFreeCertificateContext
CertDuplicateStore
CertOpenStore
CertCloseStore
CertVerifyCertificateChainPolicy
CertEnumCertificatesInStore
secur32
InitializeSecurityContextW
QueryContextAttributesW
EncryptMessage
FreeContextBuffer
DeleteSecurityContext
ApplyControlToken
DecryptMessage
AcquireCredentialsHandleA
FreeCredentialsHandle
AcceptSecurityContext
bcryptprimitives
ProcessPrng
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
user32
OpenClipboard
GetClipboardData
DefWindowProcA
RegisterClassExA
CreateWindowExA
ReleaseDC
GetDC
DestroyIcon
CreateIcon
MapVirtualKeyW
VkKeyScanW
GetCursorPos
SendInput
CloseClipboard
GetWindowLongPtrW
GetSystemMetrics
ShowWindow
DispatchMessageW
TranslateMessage
MsgWaitForMultipleObjectsEx
PeekMessageW
RegisterRawInputDevices
SetWindowLongPtrW
MessageBoxW
RedrawWindow
FlashWindowEx
GetClientRect
CreateWindowExW
RegisterClassExW
DestroyWindow
MonitorFromPoint
ValidateRect
SetWindowTextW
TrackPopupMenu
SetMenuDefaultItem
EnableMenuItem
PostMessageW
EmptyClipboard
GetActiveWindow
SendMessageW
SetWindowLongW
LoadCursorW
SetCursor
ReleaseCapture
GetWindowPlacement
SetWindowPlacement
GetMonitorInfoW
MonitorFromWindow
DefWindowProcW
GetRawInputData
GetWindowLongW
GetMenu
AdjustWindowRectEx
MapVirtualKeyExW
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
TrackMouseEvent
ScreenToClient
GetTouchInputInfo
MonitorFromRect
CloseTouchInputHandle
GetWindowRect
SetCapture
SystemParametersInfoA
GetClipCursor
ClipCursor
ShowCursor
GetKeyState
IsIconic
SetForegroundWindow
SetWindowDisplayAffinity
RegisterTouchWindow
GetAsyncKeyState
IsProcessDPIAware
SetClipboardData
DestroyCursor
GetForegroundWindow
RegisterWindowMessageA
ChangeDisplaySettingsExW
IsWindowVisible
ClientToScreen
GetSystemMenu
SetWindowPos
InvalidateRgn
shell32
DragQueryFileW
ShellExecuteW
DragFinish
gdi32
SelectObject
DeleteDC
CreateCompatibleDC
DeleteObject
CreateDIBSection
GetPixelFormat
SetPixelFormat
DescribePixelFormat
CreateRectRgn
GetDeviceCaps
ChoosePixelFormat
SwapBuffers
BitBlt
opengl32
wglMakeCurrent
wglGetCurrentContext
wglGetProcAddress
wglCreateContext
wglDeleteContext
d3dcompiler_47
D3DCompile
ole32
OleInitialize
RegisterDragDrop
CoInitializeEx
CoCreateInstance
RevokeDragDrop
CoUninitialize
imm32
ImmAssociateContextEx
ImmReleaseContext
ImmGetContext
ImmGetCompositionStringW
uxtheme
SetWindowTheme
dwmapi
DwmSetWindowAttribute
DwmEnableBlurBehindWindow
Name
.text
Size
6.0MB
Virtual Size
6.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
121.6MB
Virtual Size
121.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
316KB
Virtual Size
315KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
77KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=144, id=261, version=33145,
count=50, id=260, version=33145,
count=24, id=259, version=33145,
count=9, id=259, version=35403,
count=16, id=260, version=35403,
count=40, id=261, version=35403,
count=11, id=257, version=33145,
count=340, id=1, productName=Unmarked objects,
count=46, productName=Unmarked objects (old),
count=1, id=255, version=35723,
count=1, id=258, version=35723,