Python Executing Disguised CAT File (NarwhalRAT)

Duo Tech@duotech

•updated Jun 17, 2026•1•0•5

Detects a Python runtime (such as userscreen.exe or python.exe) executing a file with a .cat extension. This technique is used by APT37 NarwhalRAT to conceal Python bytecode payloads.