2026-08-01_3e626313bcf27a1dee942f21e35815a7_elex_mespinoza_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_3e626313bcf27a1dee942f21e35815a7_elex_mespinoza_njrat
Size 3.0MB
Sample260802-back3s1scs
SHA256 8d65ffd791fc01ab22dbd35dbbc11f2336b1ae60bd8272d8def445dcf72aa8f5
MD5 3e626313bcf27a1dee942f21e35815a7
SHA1 1d2c1e6339caae380d065e97fb977fa2f2719f8b
SHA512 c9c7773b135be6efeddf92319cd6dc4c40175b6de1e5e81e51d5d9f6d5086d3c9719706db83360339b067565f73fd4226858e21dae4cf7310b164aca6d349e21
SSDEEP 98304:7mgsf5TRq0L7NWsDzuzKsP917ArdTKieBT3yHHV:sRq0L7N/zSFP9ydTnV
TLSH
T1FDE57A1567E9C108F2F36F789974E2F9497ABD91AE35C54F12843D9F3830A60CA64B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_3e626313bcf27a1dee942f21e35815a7_elex_mespinoza_njrat

File Explorer

2026-08-01_3e626313bcf27a1dee942f21e35815a7_elex_mespinoza_njrat

.exe 3.0MB

2026-08-01_3e626313bcf27a1dee942f21e35815a7_elex_mespinoza_njrat

IMPHASH 2fca9f47d9332127bc25f3308980ce5e
SHA256 8d65ffd791fc01ab22dbd35dbbc11f2336b1ae60bd8272d8def445dcf72aa8f5
MD5 3e626313bcf27a1dee942f21e35815a7
SHA1 1d2c1e6339caae380d065e97fb977fa2f2719f8b
SHA512 c9c7773b135be6efeddf92319cd6dc4c40175b6de1e5e81e51d5d9f6d5086d3c9719706db83360339b067565f73fd4226858e21dae4cf7310b164aca6d349e21
SSDEEP 98304:7mgsf5TRq0L7NWsDzuzKsP917ArdTKieBT3yHHV:sRq0L7N/zSFP9ydTnV
TLSH
T1FDE57A1567E9C108F2F36F789974E2F9497ABD91AE35C54F12843D9F3830A60CA64B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4580112

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\projects\CastleCrashersWin32\Castle\dev\gamecode\win32\ProjectFiles\Release\CastleWin32.pdb

dinput8

DirectInput8Create

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSetStatusCallback WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse

hid

HidD_GetHidGuid HidD_GetSerialNumberString

setupapi

SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdA SetupDiGetDeviceInterfaceDetailA SetupDiGetClassDevsA SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

d3d9

Direct3DCreate9

d3dx9_43

D3DXSaveTextureToFileA D3DXMatrixOrthoOffCenterLH D3DXCreateTextureFromFileExA D3DXGetImageInfoFromFileA D3DXCreateTexture D3DXCreateTextureFromFileInMemoryEx D3DXGetImageInfoFromFileInMemory

steam_api

SteamInternal_ContextInit SteamAPI_GetHSteamUser SteamAPI_RegisterCallResult SteamAPI_UnregisterCallResult SteamInternal_FindOrCreateUserInterface SteamAPI_UnregisterCallback SteamAPI_RegisterCallback SteamAPI_Shutdown SteamInternal_SteamAPI_Init SteamInternal_CreateInterface SteamAPI_RunCallbacks SteamAPI_SetMiniDumpComment SteamAPI_WriteMiniDump

kernel32

GetCPInfo GetOEMCP IsValidCodePage GetCommandLineA GetCommandLineW GetEnvironmentStringsW FindNextFileW FindFirstFileExW DecodePointer EncodePointer SetStdHandle GetCurrentDirectoryW DeleteFileW ReadConsoleW SetFilePointerEx GetStringTypeW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetTimeZoneInformation GetConsoleMode GetConsoleCP FlushFileBuffers HeapAlloc HeapFree GetACP GetStdHandle GetModuleFileNameW ExitProcess FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetCurrentThreadId Sleep GetModuleHandleA GetLastError WaitForSingleObject ResumeThread CloseHandle RaiseException IsDebuggerPresent ReleaseSemaphore CreateSemaphoreA GetTickCount64 QueryPerformanceFrequency CreateEventA ReadFile CancelIo GetProcessHeap FreeEnvironmentStringsW CreateFileA ResetEvent GetOverlappedResult FindFirstFileA FindNextFileA GetFullPathNameA FindClose GetFileAttributesA SetFileAttributesA RemoveDirectoryA CreateDirectoryA GetDateFormatA EnumDateFormatsExA LoadLibraryA GetProcAddress GetTickCount GetCurrentProcess SetFilePointer SetEvent GetUserDefaultLCID OutputDebugStringA GetFileSize QueryPerformanceCounter GetLocalTime GetModuleFileNameA SetThreadPriority CreateThread LocalFree CreateFileW GetFullPathNameW GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ExitThread WideCharToMultiByte MultiByteToWideChar SetLastError RtlUnwind LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc SetEndOfFile InitializeCriticalSectionAndSpinCount InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW GetModuleHandleW CreateEventW WaitForSingleObjectEx IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SetEnvironmentVariableA DeviceIoControl WriteConsoleW HeapSize HeapReAlloc WriteFile

user32

MessageBoxW SetWindowPos DestroyWindow LoadCursorA SetRect AdjustWindowRectEx ShowWindow GetAsyncKeyState GetCursorInfo SetWindowLongA ClientToScreen ChangeDisplaySettingsA TrackMouseEvent MoveWindow AdjustWindowRect RegisterClassA CreateWindowExA SetFocus SetCursor LoadIconA GetClientRect UnregisterClassA UpdateWindow SetForegroundWindow ShowCursor SetCursorPos GetCursorPos MessageBoxA DispatchMessageA ScreenToClient GetSystemMetrics DefWindowProcA TranslateMessage PeekMessageA PostQuitMessage GetWindowRect GetDesktopWindow

gdi32

GetStockObject

comdlg32

GetOpenFileNameA

shell32

ord644 SHCreateItemFromIDList ShellExecuteA SHFileOperationA ord645 ord2 SHParseDisplayName CommandLineToArgvW ord4

ole32

CoUninitialize CoSetProxyBlanket CoCreateInstance CoInitialize CoTaskMemFree CoInitializeEx

oleaut32

SysFreeString SysAllocString

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

715KB

Virtual Size

714KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

284B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

346KB

Virtual Size

345KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

139KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.bind

Size

185KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_3e626313bcf27a1dee942f21e35815a7_elex_mespinoza_njrat

dinput8

winhttp

hid

setupapi

wtsapi32

d3d9

d3dx9_43

steam_api

kernel32

user32

gdi32

comdlg32

shell32

ole32

oleaut32

generic