NjRAT

njRAT, also known as Bladabindi, is a remote access tool (RAT) with user interface or trojan which allows the holder of the program to control the end-user's computer. It was first found in June 2013 with some variants traced to November 2012. It was made by a hacking organization from different countries called M38dHhM and was often used against targets in the Middle East. It can be spread through phishing and infected drives.
To date, there are many versions of this virus, the most famous of which is njRAT Green Edition.

About the program and its whereabouts 

A surge of njRAT attacks was reported in India in July 2014. In an attempt to disable njRAT's capabilities, Microsoft took down four million websites in 2014 while attempting to filter traffic through no-ip.com domains.

In March 2016, Softpedia reported that spam campaigns spreading remote access trojans such as njRAT were targeting Discord. In October 2020, Softpedia also reported the appearance of a cracked VMware download that would download njRAT via Pastebin. Terminating the process would crash the computer.

An Islamic State website was hacked in March 2017 to display a fake Adobe Flash Player update download, which instead downloaded the njRAT trojan.

In January 2023, outbreaks of Trojan infections were seen in the Middle East. The attackers used .cab files with supposedly political conversation, when opened, they launched a .vbs script that downloaded malware from the cloud.

Architecture 

NjRAT, like many remote access trojans, works on the principle of a reverse backdoor, that is, it requires open ports on the attacker's computer. After creating the malware (client) and opening it, the attacker's server receives a request from the client side. After a successful connection, the attacker can control the victim's computer by sending commands to the server when the client part processes them. Additionally, the trojan can inject its code into legitimate processes such as RegSvcs.exe and RegAsm.exe, as well as run itself through Task Scheduler.

Features 

The following list of features is not exhaustive, but is critical to understanding the capabilities of this Trojan.
 Are common
 Manipulate files
 Open a remote shell, allowing the attacker to use the command line
 Open a process manager to kill processes
 Manipulate the system registry
 Record the computer's camera and microphone
 Log keystrokes
 Remote desktop (management of a search box and keyboard, obtaining a monitor image)
 Steal passwords stored in web browsers or in other applications-.3

 Green Edition
 Change icon when creating a virus
 Some comic functions of the "fun" section

 Golden Edition
 Port check
 Selecting the connection protocol (TCP or UDP)
 prohibition of processes by the method of interval closure

 Danger Edition
 Ability to add a password to the server
 News window 
 Artificially increase the weight of the final virus 
 Possibility to add the function of prohibiting processes to the virus 
 Changeable DNS server persistence feature

Versions 

 njRAT 0.11G
 njRAT 0.7d
 njRAT 0,7d Green Edition
 njRAT 0,7d Golden Edition
 njRAT 0,7d Danger Edition
 njRAT 0,7d Lime Edition
 njRAT 0,7d Platinum Edition
 njRAT 0,7d Ultimate Edition
 njRat 0,7d Horror Edition
 njRat 0,7d Red Edition
 njRat 0,7d 808

Detections 

Common antivirus tags for NjRAT are as follows:

W32.Backdoor.Bladabindi
Backdoor.MSIL.Bladabindi
Backdoor/Win.NjRat.R512373

The standard version of the Trojan lacks encryption algorithms, which is why it can be easily detected by antivirus. However, an attacker can encrypt it manually, so that it will not be detected by popular antivirus software.

References

Trojan horses
2012 in computing
Windows trojans