Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 06:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe
- Size 2.0MB
- Sample260823-g99yhseq2y
- SHA256 9578048b1ee4bf4f89cff34a98c9944783bc9607372e9f23bd7cc4ef9e0ec384
- MD5 7488bdfea62050741b964ee2235bf10c
- SHA1 f1b7b87af7ec268682a4053a28589f8965d86754
- SHA512 fd4d020fa45189310e94715313ca8bbd6e0e739092202c041399078191048e394af37bbc7c2db9befc47a9cc7abf8ee725a8a1f1a1e2caea70ffeab30cada741
- SSDEEP 49152:dzrAePqWERYIXvDNvOTXlznKO/6VfCmsA2k:qpdRnoKO/6BFb
- TLSH T18FA57D83EDF749A5C079B8F489478229AA20F85E0934754F1BFC1534EFBB3A05BDA641
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe 1288 2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_7488bdfea62050741b964ee2235bf10c_mespinoza_njrat_stealc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1288