CatClawAgent[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
CatClawAgent.exe
Size 46KB
Sample260705-ry3eeacz5x
SHA256 5a7fd484b0e853fe5bcdbf6daa7a7a57716c153ddf7922d3f833284a92520e18
MD5 5140c530a256b5b29d42ee4f30936e97
SHA1 ebe3634a3ed76157deab58799b7cd32b1d6385b1
SHA512 e1e2c98bad1750664853a5f806cc0b538d8f4c2a822b39636826a2b2375a410162fc645a35ec4f71026ead9e0dd92524b568013ceb00cffb58c01a0d0cc4d840
SSDEEP 768:ozlj7CN82cD47HJNFyIKrK9uSLK669cDhMWib9XXMRSZGvd0YGfgHyq:gA8abJhK29r2669cDhG5nM88mZhq
TLSH
T1B723E926DD17912FD31EDDB9D5530C01EE22BCC64BE1B9CF97401CE6096AAE49B3EA01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CatClawAgent.exe

File Explorer

CatClawAgent.exe

.exe 46KB

CatClawAgent.exe

IMPHASH cfeb8d54cd1d446f6619345f580ea616
SHA256 5a7fd484b0e853fe5bcdbf6daa7a7a57716c153ddf7922d3f833284a92520e18
MD5 5140c530a256b5b29d42ee4f30936e97
SHA1 ebe3634a3ed76157deab58799b7cd32b1d6385b1
SHA512 e1e2c98bad1750664853a5f806cc0b538d8f4c2a822b39636826a2b2375a410162fc645a35ec4f71026ead9e0dd92524b568013ceb00cffb58c01a0d0cc4d840
SSDEEP 768:ozlj7CN82cD47HJNFyIKrK9uSLK669cDhMWib9XXMRSZGvd0YGfgHyq:gA8abJhK29r2669cDhG5nM88mZhq
TLSH
T1B723E926DD17912FD31EDDB9D5530C01EE22BCC64BE1B9CF97401CE6096AAE49B3EA01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Vd201\source\repos\CatClawAgent\x64\Release\CatClawAgent.pdb

kernel32

ExitProcess GetModuleHandleW GlobalUnlock GlobalLock GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter MoveFileExW CloseHandle CreateFileA GetLastError Sleep GetModuleFileNameW QueryPerformanceCounter WriteFile

user32

GetSystemMetrics CallNextHookEx GetDC GetKeyNameTextA OpenClipboard MapVirtualKeyW UnhookWindowsHookEx ReleaseDC SetWindowsHookExW GetClipboardData CloseClipboard

gdi32

DeleteDC GetDIBits CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt DeleteObject

msvcp140

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z

winhttp

WinHttpOpen WinHttpReceiveResponse WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpQueryDataAvailable WinHttpConnect

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception_context __std_exception_destroy __std_exception_copy __std_terminate memcmp memcpy memmove __C_specific_handler __current_exception

api-ms-win-crt-heap-l1-1-0

free _callnewh _set_new_mode malloc

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e exit _exit _seh_filter_exe __p___argc _get_initial_narrow_environment _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _cexit terminate _crt_atexit __p___argv _set_app_type _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

strlen