BLACK FRIDAY: 2-for-1 offer NOVEMBER 20 - 26 See details
2
Global rank
5 infographic chevron month
Month rank
5 infographic chevron week
Week rank
1374
IOCs

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Trojan
Type
Middle East
Origin
1 January, 2013
First seen
28 February, 2024
Last seen
Also known as
Bladabindi
Njw0rm

How to analyze njRAT with ANY.RUN

Type
Middle East
Origin
1 January, 2013
First seen
28 February, 2024
Last seen

IOCs

IP addresses
51.222.15.27
147.185.221.18
193.161.193.99
141.95.84.40
2.56.152.93
185.204.1.236
31.180.175.236
85.172.91.115
147.185.221.17
37.75.98.113
45.142.182.104
222.186.174.9
147.30.228.190
5.39.43.50
38.180.15.140
194.38.20.230
85.192.32.83
191.233.28.7
176.105.216.80
65.0.50.125
Hashes
4436009a62aa401a10657360bff4ac1726f7460db3159df984d356b9ec8b12e2
9b9c6f46ff50a1df7a0d8c904e24ccdac89882b2d2ffd1aac3048e4cd37507e4
a4ce58f327d17a6eb8e0e95dc7ad3daf57c49278633d76beacee4097d712e977
9f9b759776ec7c67a1596eeea75052ffee443e984bba8a9697fc1b511b5ac738
59d6e2958780d15131c102a93fefce6e388e81da7dc78d9c230aeb6cab7e3474
570bb899990ee416a78bafee27264f54ee9afe591cf69525b8814740bef2fc01
512deef8234626e97c6e9301979e81cd18cb32dc01aa3438215781b31fe8cc23
1e99de794975e9fbfe0000943046ce2e25a69eb705ac09400a858f530d72ebd7
b994431bce8f88d60bf5acd4d342aedc793d8b103f57767d05be42acf411d969
663c2b9e7d92bf199c066fe3f0f7f99092d280993ffabee22b42483b55d4b4c5
a6a8d36a23bd47550e12484113930f364129f5436a98fa7c5efc9cf9b4fa9cb6
096d974a744eff570c7e45a9da310768215f218295f18030de2a3459b55feb90
290c8bc9749beffe992fd705892766b1b168c4758a38e336a96d92fd67439b09
4b65129befab838aac1e38cb32bb5594c5761dee933b283588166018bfe191b7
7a3a9bed1252cd09631efc4670523563adf8402eeac3aaaf7fdd90a2e586ff9a
2f0841679396ef33442ad3bd085db72b86d1ab99b0356a1e0e30db20e32ce0fa
948334a4a5761a77078c9af37c39ecafc4ebb530ae4d14df75c32fd294e6c651
ede44b57b674468119b1f379f5107baaed4b4d8aaf587c8318552f652bdd5016
bab4d04142e34c86f97a71415bd6032a6284fe29c1c0886b6abd6772c0d37a92
1daf71381dccf154a2551351624177a495d8c93aec0be2460ee4fa2c7c19c1b9
Domains
njnjnjs.duckdns.org
clarosecurity-com.duckdns.org
berlyndinero.duckdns.org
searchwin.ddns.net
daleriamz.ddns.net
soa7.zapto.org
ronymahmoud.casacam.net
main-peers.at.ply.gg
0.tcp.eu.ngrok.io
alcachofa724-46937.portmap.host
timothe.zapto.org
junio2023.duckdns.org
0.tcp.sa.ngrok.io
18.ip.gl.ply.gg
seznam.zapto.org
being-bold.gl.at.ply.gg
manual-faq.gl.at.ply.gg
17.ip.gl.ply.gg
7.tcp.eu.ngrok.io
nuncacaerenmalware.com
URLs
https://pt.textbin.net/download/insdj4bhn2
https://pastes.io/download/g4enqwgps4
https://pastebin.com/raw/Hu1K7Y4W
https://pastebin.com/raw/VGGi28kN
https://pastebin.com/raw/jxx7yjgK
https://6ded-177-50-200-148.ngrok-free.app/
https://pastebin.com/raw/vZM3LPTw
https://pt.textbin.net/download/rcd5ihynxw
https://pastebin.com/raw/UgsiXFgH
https://pastebin.com/raw/YKgY3s0H
https://pastebin.com/raw/rdmzbeYW
https://pastebin.com/raw/fnugwhmF
https://pastebin.com/raw/CmJ80yPc
https://pastebin.com/raw/MiKBEm2x
https://pastebin.com/raw/LPn410Wj
https://pastebin.com/raw/GUZjvbiL
https://pastebin.com/raw/q6JvsRJz
https://pastebin.com/raw/S1HhZSCU
https://pastebin.com/raw/0mKM5dgn
https://pastebin.com/raw/TiVt9TvE
Last Seen at

Recent blog posts

post image
DCRat: Step-by-Step Analysis in ANY.RUN
watchers 839
comments 0
post image
Analyzing Linux Malware in ANY.RUN: 3 exampl...
watchers 328
comments 0
post image
What is Crypto Malware: Definition and Analys...
watchers 312
comments 0

What is njRAT Malware?

njRAT, also called Bladabindi and Njw0rm is a remote access trojan that is used to remotely control infected machines. Because of its availability, excess of online tutorials, plenty of information, and a robust core feature set along with several implemented evading techniques made njRAT one of the most widely used RATs in the world.

This malware was detected for the first time in 2013, however, some related RATs have been observed by researchers in 2012. The highest surge of njRAT trojan attacks was recorded in 2014 in the middle east, which is the most targeted region for this malware.

General Information about njRAT

njRAT trojan is built on the .NET framework. This RAT gives hackers the ability to control the victim’s PC remotely. njRAT allows attackers to activate the webcam, log keystrokes, and steal passwords from web browsers as well as multiple desktop apps.

In addition, the malware gives hackers access to the command line on the infected machine. It allows to kill processes as well as remotely execute and manipulate files. On top of that, njRAT is capable of manipulating the system registry. When infected, Bladabindi trojan will collect several bits of information about the PC that it got into, including the name of the computer, operating system number, country of the computer, usernames, and OS version.

Also, this malware is able to target cryptocurrency wallet applications and steal cryptocurrency from PCs. For example, it is known to be able to grab bitcoins and even access credit card information which sometimes can be stored in crypto apps as a means to purchase cryptocurrency.

After infecting a computer the malware uses a variable name and copies into %TEMP%, %APPDATA%, %USERPROFILE%,%ALLUSERSPROFILE% or %windir% – a behavior not uncommon for this time of malware. It can also copy itself into <any string>.exe, to ensure that it will be activated every time the victim switches on their computer.

njRAT trojan has a few tricks up its sleeve to avoid detection by antivirus software. For example, it uses multiple .NET obfuscators to obstruct its code. Another technique that the malware uses is disguising itself into a critical process. This does not allow the user to shut it down. It also makes njRAT hard to remove from the infected PCs. Bladabindi RAT can also deactivate processes that belong to antivirus software, allowing it to stay hidden. njRAT also knows how to detect if it has been run on a virtual machine which helps the attackers to set up countermeasures against researchers.

Use ANY.RUN free for 14 days

Try the full power of interactive analysis

Start your free trial

Authors of Bladabindi are leveraging Pastebin to avoid investigation by cybersecurity researchers. njRAT downloads additional components and executes secondary-stage payloads from Pastebin. So, the malware has no need to establish a traditional command-and-control (C2) server. The Pastebin creates a pathway between njRAT infections and new payloads. With the trojan acting as a downloader, it will grab encoded data dumped on Pastebin, decode, and deploy.

For spreading, njRAT can detect external hard drives connected via USB. Once such a device is detected, the RAT will copy itself onto the connected drive and create a shortcut.

Who created njRAT?

Creators of njRAT are members of an underground hacker community named Sparclyheason. Evidently, they have created a very popular and destructive malware. njRAT was classified as “severe” by Microsoft Malware Protection Center.

In fact, following a large malicious campaign in 2014, Microsoft shut down four million websites in an effort to filter traffic that was going through no-ip.com domains.

njRAT malware analysis

ANY.RUN allows researchers to watch the njRAT in action in an interactive sandbox simulation.

njRAT execution process graph

Figure 1: Displays the lifecycle of njRAT in a visual form as a process graph generated by ANY.RUN malware hunting service

text report of the njRAT malware analysis

Figure 2: A customizable text report generated by ANY.RUN allows to take an even deeper look at the malware and helps to share the research results

njRAT execution process

In our simulation, after njRAT got into the target device and began execution it instantly started its malicious activity. Usually, the initial file renames itself and creates a child process. Sometimes njRAT trojan injects its code into legitimate processes such as RegSvcs.exe and RegAsm.exe.

The malware also has the ability to run itself through Task Scheduler. This child process executes the main malicious activity. Such activity includes stealing information, connecting to C2 servers, and changing the autorun value in the registry to run itself when the operating system starts.

Distribution of njRAT

njRAT trojan uses quite a few attack vectors to infect its victims. For example, the malware is known to target Discord users as part of spam campaigns. In addition, leverage cracks and keygens in well-known software in order to trick users. It installs malicious packages to infect the machine.

Another known distribution method was through a compromised website that tricked users into downloading a fake Adobe product update which in turn installed njRAT malware to the PC. Bladabindi was also featured in spam email campaigns. In this case, it was delivered to potential victims as a malicious attachment.

In October 2020 mailspam used the 'shipment tracking' theme, faking popular courier and postal services. Malicious packages contain attachments in Zip format with an encoded Visual Basic script (VBE) payload and components.

Moreover, crooks use cloud-based storage platforms more often. Attackers host malicious files there to deliver malicious software, and even use them as part of a command and control (C&C) architecture. That is why it's crucial to know general malware removal instructions and analyze viruses in a safe environment.

How to detect NJRAT using ANY.RUN?

To determine whether the sample under review is njRAT or not, you can take a look at the changes that it made in the registry. To do so, open the "Advanced details of process" of the malicious process and look at the "Registry changes" tab in the "Events" section. If a process has created a key with the name [kl] into the path HKEY_CURRENT_USER\Software\32_characters_and_digits, you can be sure that the given sample is njRAT.

njrat registry changes Figure 3: Сhanges made by njRAT in registry

Conclusion

The relative ease of operation, multiple tutorials on how to set up this malware, and very extensive information stealing feature set have made this RAT one of the most popular remote access trojans in the world.

Even though the peak of its activity was recorded in 2014 and targeted mostly the middle east and India, the njRAT trojan remains to be extremely popular today. This malware is known to have targeted both private and corporate victims and poses a lot of danger to internet users, especially considering that it can be delivered by packages to potential victims in several ways, and preventing infection is much harder in some cases than in others.

Even though Bladabindi malware creators have taken several steps to hinder the analysis, malware hunting services like ANY.RUN allows professionals to easily study njRAT malware samples or other RATs like Orcus RAT or WSHRAT and share the research results with the world to improve global cybersecurity.

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Amadey screenshot
Amadey
amadey
Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.
Read More
Arkei screenshot
Arkei
arkei stealer
Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.
Read More
AsyncRAT screenshot
AsyncRAT
asyncrat
AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.
Read More
WarZone screenshot
WarZone
warzone avemaria stealer trojan rat
WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.
Read More

Our website uses cookies. By visiting the pages of the site, you agree to our Privacy Policy