njRAT

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Type
Trojan
Origin
Middle East
First seen
1 January, 2013
Last seen
23 October, 2021
Also known as
Bladabindi
Njw0rm
Global rank
2
Week rank
2
Month rank
2
IOCs
21745

What is njRAT Malware?

njRAT, also called Bladabindi and Njw0rm is a remote access trojan that is used to remotely control infected machines. Because of its availability, excess of online tutorials, and a robust core feature set along with several implemented evading techniques made njRAT one of the most widely used RATs in the world.

This malware was detected for the first time in 2013, however, some related RATs have been observed by researchers in 2012. The highest surge of njRAT trojan attacks was recorded in 2014 in the middle east, which is the most targeted region for this malware.

General description of njRAT

njRAT trojan is built on .NET framework. This RAT gives hackers the ability to control the victim’s PC remotely. njRAT allows attackers to activate the webcam, log keystrokes, and steal passwords from web browsers as well as multiple desktop apps.

In addition, the malware gives hackers access to the command line on the infected machine. It allows to kill processes as well as remotely execute and manipulate files. On top of that, njRAT is capable of manipulating the system registry. When infected, Bladabindi trojan will collect several bits of information about the PC that it got into, including the name of the computer, operating system number, country of the computer, usernames, and OS version.

Also, this malware is able to target cryptocurrency wallet applications and steal cryptocurrency from PCs. For example, it is known to be able to grab bitcoins and even access credit card information which sometimes can be stored in crypto apps as a means to purchase cryptocurrency.

After infecting a computer the malware uses a variable name and copies into %TEMP%, %APPDATA%, %USERPROFILE%,%ALLUSERSPROFILE% or %windir% – a behavior not uncommon for this time of malware. It can also copy itself into <any string>.exe, to ensure that it will be activated every time the victim switches on their computer.

njRAT trojan has a few tricks up its sleeve to avoid detection by antivirus software. For example, it uses multiple .NET obfuscators to obstruct its code. Another technique that the malware uses is disguising itself into a critical process. This does not allow the user to shut it down. It also makes njRAT hard to remove from the infected PCs. Bladabindi RAT can also deactivate processes that belong to antivirus software, allowing it to stay hidden. njRAT also knows how to detect if it has been run on a virtual machine which helps the attackers to set up countermeasures against researchers.

Authors of Bladabindi are leveraging Pastebin to avoid investigation by cybersecurity researchers. njRAT downloads additional components and executes secondary-stage payloads from Pastebin. So, the malware has no need to establish a traditional command-and-control (C2) server. The Pastebin creates a pathway between njRAT infections and new payloads. With the trojan acting as a downloader, it will grab encoded data dumped on Pastebin, decode, and deploy.

For spreading, njRAT can detect external hard drives connected via USB. Once such a device is detected, the RAT will copy itself onto the connected drive and create a shortcut.

Who created njRAT?

Creators of njRAT are members of an underground hacker community named Sparclyheason. Evidently, they have created a very popular and destructive malware. njRAT was classified as “severe” by Microsoft Malware Protection Center.

In fact, following a large malicious campaign in 2014, Microsoft shut down four million websites in an effort to filter traffic that was going through no-ip.com domains.

njRAT malware analysis

ANY.RUN allows researchers to watch the njRAT in action in an interactive sandbox simulation.

njRAT execution process graph

Figure 1: Displays the lifecycle of njRAT in a visual form as a process graph generated by ANY.RUN malware hunting service

text report of the njRAT malware analysis

Figure 2: A customizable text report generated by ANY.RUN allows to take an even deeper look at the malware and helps to share the research results

njRAT execution process

In our simulation, after njRAT got into the target device and began execution it instantly started its malicious activity. Usually, the initial file renames itself and creates a child process. Sometimes njRAT trojan injects its code into legitimate processes such as RegSvcs.exe and RegAsm.exe.

The malware also has the ability to run itself through Task Scheduler. This child process executes the main malicious activity. Such activity includes stealing information, connecting to C2 servers, and changing the autorun value in the registry to run itself when the operating system starts.

Distribution of njRAT

njRAT trojan uses quite a few attack vectors to infect its victims. For example, the malware is known to target Discord users as part of spam campaigns. In addition, leverage cracks and keygens in well-known software in order to trick users. It installs malicious packages to infect the machine.

Another known distribution method was through a compromised website that tricked users into downloading a fake Adobe product update which in turn installed njRAT malware to the PC. Bladabindi was also featured in spam email campaigns. In this case, it was delivered to potential victims as a malicious attachment.

In October 2020 mailspam used the 'shipment tracking' theme, faking popular courier and postal services. Malicious packages contain attachments in Zip format with an encoded Visual Basic script (VBE) payload and components.

Moreover, crooks use cloud-based storage platforms more often. Attackers host malicious files there to deliver malicious software, and even use them as part of a command and control (C&C) architecture.

How to detect NJRAT using ANY.RUN?

To determine whether the sample under review is njRAT or not, you can take a look at the changes that it made in the registry. To do so, open "Advanced details of process" of the malicious process and look at the "Registry changes" tab in the "Events" section. If a process has created a key with the name [kl] into the path HKEY_CURRENT_USER\Software\32_characters_and_digits, you can be sure that the given sample is njRAT.

njrat registry changes Figure 3: Сhanges made by njRAT in registry

Conclusion

The relative ease of operation, multiple tutorials on how to set up this malware, and very extensive information stealing feature set have made this RAT one of the most popular remote access trojans in the world.

Even though the peak of its activity was recorded in 2014 and targeted mostly the middle east and India, njRAT trojan remains to be extremely popular today. This malware is known to have targeted both private and corporate victims and poses a lot of danger to internet users, especially considering that it can be delivered by packages to potential victims in several ways, and preventing infection is much harder in some cases than in others.

Even though Bladabindi malware creators have taken several steps to hinder the analysis, malware hunting services like ANY.RUN allows professionals to easily study njRAT malware samples and share the research results with the world to improve global cybersecurity.

IOCs

IP addresses
3.140.223.7
206.81.28.165
104.248.133.59
165.227.31.192
3.22.30.40
3.134.125.175
3.13.191.225
3.134.39.220
47.63.150.250
3.142.167.54
3.142.167.4
13.59.15.185
13.59.15.185
3.142.129.56
3.22.53.161
3.138.45.170
52.14.18.129
3.131.207.170
3.129.187.220
3.133.207.110
Hashes
7c7bfcd4363a4d32578500f473e1d05597ab918fd76d415d884a8aef7daff257
f6d2343f4669c093553e5fd48d3a84df212c2d56dd6cb337d89179a656ef6dbd
8afe5fe8f8b31a6044e3949dea8c5c6c9f7083a340bf302ee166d176d2ccc334
60b671201b8ec920e917b33dd8e1377a85bac023cc83a4adecfd25260e43c067
49ed65cb7499ddc178524ddb13c5a065b6a143d1ed4e92da787d3a06bc31ed08
e5a4e8eda9d21d29b21f4d665823cdcbf9fb7004c8a4e6f74df126249b46c67f
f16d27e6ecb15959b6d6c8d0689cdfd939fd3964f7ecca7c0aa8bf2e88690634
88e543bf4c2b648aab0c58cbd4ede89e45730cfd05732497d58ae43d693b68a4
684b6897774fb63615600c352063164f14af5dc8e8cf1f6d057b231e7285be61
603834f8c4b62e24cb7e6cc810daeca7489bcc7162b101fbf38365ddf4f581fa
8ed715b9743f4642d0de12bee72d8ebb52a6d4fbcb03297c092b4f7f33067585
0acc05c513a9cb1ffd8ecde91b10b2dfcfbc23bf3e5fdd81c368495ffff4a41b
0b6380540370144731f6270964825ad45f1a49ec88f85badca9be2c2881629a8
09ceffa96a38c16c1932e595c4e584ee865100026e7796780fdefc8b5827d669
97de3368448c182e8c9ef330a764a567ca6f7442c7483b8cb546727b2331197a
3de46ee756c667a8eaa3c90dbad2c6fc91ec48b069a236199b77b50750468dda
85c592312019b0c16b5a3658d5ae4136d5bd64c5d7d00c03949c074d61df289e
7c634ed81f3a29b5e1a0252c091d2a3dc85ad3f5e6dde7c95cebaa7848ad3d55
dfcacbbb756f573da0101c12ad70bed4be19ac9ca9666609955c2d7a8bf2fab8
c2d6b72511516397832f8a40fe3762141d62c78074dac77718f819b1fe7acaf8
Domains
6.tcp.ngrok.io
isns.net
svalkagovna228.hopto.org
fevertox.duckdns.org
focused-fog-74469.pktriot.net
us-west-11608.packetriot.net
lucid-haze-60556.pktriot.net
3956-2401-4900-1212-9889-85f1-f6cb-5874-cd0b.ngrok.io
c61b-107-161-81-158.ngrok.io
eb27-2409-4064-4e05-c76d-2451-9fc1-f981-84f2.ngrok.io
0f70-34-121-202-111.ngrok.io
221a-34-134-220-19.ngrok.io
rusbje.ngrok.io
e7b9-2409-4064-4e1d-a3e5-6d28-b762-b15b-f780.ngrok.io
cc6a-14-102-21-201.ngrok.io
eaed-45-153-160-138.ngrok.io
8a44f9c.ngrok.io
086d-152-32-98-6.ngrok.io
fb2f86b476ec.ngrok.io
2002a5-192-145-164-6.ngrok.io

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Ave Maria screenshot
Ave Maria
avemaria stealer trojan rat
Ave Maria malware is a Remote Access Trojan that is also called WARZONE RAT. Hackers use it to control the PCs of their victims remotely and steal information from infected PCs. For example, they can remotely activate the camera to take pictures of a victim and send them to a control server.
Read More
Azorult screenshot
Azorult
azorult trojan rat
AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.
Read More
Crimson RAT screenshot
Crimson RAT
crimson rat trojan
Crimson is a Remote Access Trojan — a malware that is used to take remote control of infected systems and steal data. This particular RAT is known to be used by a Pakistani founded cybergang that targets Indian military objects to steal sensitive information.
Read More
Danabot screenshot
Danabot
danabot trojan stealer
Danabot is an advanced banking Trojan malware that was designed to steal financial information from victims. Out of the Trojans in the wild, this is one of the most advanced thanks to the modular design and a complex delivery method.
Read More