NjRATMalware
- bladabindi
- lime-worm
RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its…From MISP Galaxy
Last reported 8 days ago, by SecurityWeek3 reports
ATT&CK techniques
6 of 51 · each with the sentence it comes from- T1056.001Keylogging
“Built on NjRAT foundations, it offers credential theft, keylogging, hidden VNC, ransomware and a crypto clipper.”
- T1053.005Scheduled Task
“It created a scheduled task named ChromeUpdate, made to look like a Google Chrome update, which launches it at every login with the highest available privileges.”
- T1555.004Windows Credential Manager
“In Group-IB’s testing, the trojan logged keystrokes and accessed Windows Credential Manager, which stores login details for websites, network resources and Windows applications.”
- T1010Application Window Discovery
“…(T1057), Software (T1518), Query Registry (T1012), System Owner/User (T1033), System Location (T1614/.001), Account (T1087), App Window (T1010), File & Directory (T1083)”
- T1012Query Registry
“System Info (T1082), Process (T1057), Software (T1518), Query Registry (T1012), System Owner/User (T1033), System Location (T1614/.001), Account (T1087), App Window (T1010), File & Directory (T1083)”
- T1014Rootkit
“…nctionality includes registry editing, process and service management, UAC bypass and privilege escalation, persistence mechanisms, and rootkit capabilities, all wrapped in stealth features designed to minimize the malware’s footprint.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit“Built on NjRAT foundations, it offers credential theft, keylogging, hidden VNC, ransomware and a crypto clipper.”
-
KGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims“The malware, called KGB RAT, was analyzed by Group-IB malware analysts Alpomish Asadov and Razvan Raducu, who found that it is built on NjRAT, a well-known remote access trojan used by attackers of varying skill.”
-
KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize“Static analysis via Detect It Easy immediately identifies the sample as NjRAT (0.7D Lime Edition, obfuscated), a well-known commodity RAT (malpedia, MITRE) widely used by threat actors of varying sophistication.”
Indicators in its reports
named in the reports above- vb[.]netin 1 report
Copy this indicator · defanged
Thanks — we review every report.