APT37 NarwhalRAT: pythonw.exe renamed after python.org download via BAT/CMD

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•4

Detects a multi-stage attack chain where a system downloads a Python embeddable package via curl, renames the 'pythonw.exe' executable to an arbitrary name, and subsequently executes this renamed binary or a file containing 'config.cat', which is often indicative of automated malware deployment or persistence mechanisms.