CatClawAgent[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
CatClawAgent.exe
Size 42KB
Sample260705-spvtmsc17z
SHA256 642024c2825a868408ece0be90fe5f84bd32ca900057a7d4f0db8f4b6c37dbe6
MD5 ce47b2ade47f04e380c862c31a358c8f
SHA1 2eddb5603c4ebafbe460e38447350846c70396a5
SHA512 90f4f319f645f173de43640456adba88ec2d16bbcb28932fbbb04c34e23619680314ec125698852680ff2ca03a0e1673cd70413efe2cc88e9cb73ec362f80846
SSDEEP 768:Y+7vZETCG9FRz6o96GMFuofAqcsyWX7U4nH78:Y+DaTlz6o96GBqjR7Lb8
TLSH
T1A613D726DE16A03FD35E9DB8CA430C05DE62BCC69BD1B8CF57411CE60D69AE49B3E502
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CatClawAgent.exe

File Explorer

CatClawAgent.exe

.exe 42KB

CatClawAgent.exe

IMPHASH 9a699363c207e6f53c2abdbb1c1b588c
SHA256 642024c2825a868408ece0be90fe5f84bd32ca900057a7d4f0db8f4b6c37dbe6
MD5 ce47b2ade47f04e380c862c31a358c8f
SHA1 2eddb5603c4ebafbe460e38447350846c70396a5
SHA512 90f4f319f645f173de43640456adba88ec2d16bbcb28932fbbb04c34e23619680314ec125698852680ff2ca03a0e1673cd70413efe2cc88e9cb73ec362f80846
SSDEEP 768:Y+7vZETCG9FRz6o96GMFuofAqcsyWX7U4nH78:Y+DaTlz6o96GBqjR7Lb8
TLSH
T1A613D726DE16A03FD35E9DB8CA430C05DE62BCC69BD1B8CF57411CE60D69AE49B3E502
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Vd201\source\repos\CatClawAgent\x64\Release\CatClawAgent.pdb

kernel32

GetModuleHandleW GlobalUnlock QueryPerformanceCounter MoveFileExW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter ExitProcess GlobalLock CloseHandle CreateFileA Sleep GetModuleFileNameW GetCurrentProcessId WriteFile

user32

CallNextHookEx GetDC MapVirtualKeyW GetSystemMetrics GetKeyNameTextA OpenClipboard ReleaseDC UnhookWindowsHookEx SetWindowsHookExW GetClipboardData CloseClipboard

gdi32

DeleteDC GetDIBits CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt DeleteObject

msvcp140

?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

winhttp

WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpConnect WinHttpSendRequest

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception_context __std_exception_destroy __std_exception_copy __std_terminate memcmp memcpy memmove __C_specific_handler __current_exception

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode _callnewh

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e exit _exit _seh_filter_exe __p___argc _get_initial_narrow_environment _c_exit _register_thread_local_exe_atexit_callback _cexit terminate _crt_atexit __p___argv _configure_narrow_argv _set_app_type _register_onexit_function _initialize_onexit_table _initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

strlen