NjRAT | Bedrohungsstufe: high | Typ: RAT
Kryptografische Kennungen
| SHA256 | c706f26e9415008e1a59ae096932524bf0235a8fd003d476c2fb6a1684fa3070 |
|---|---|
| MD5 | 54a357601a27f1d140a46df93f8ff3cf |
| Dateityp | exe |
| Größe | 953.0 KB |
| Erstsichtung | 2026-03-01 |
| Dateiname | Not a rat.exe |
| Tags | exe, NjRAT |
Malware-Familie: NjRAT
NjRAT, Orta Doğu'da yaygın RAT'tır.
| Typ | RAT |
|---|---|
| Programmiersprache | VB.NET |
| Zielplattform | Windows |
| C2-Protokoll | TCP |
| Zweck | Uzaktan erişim, tuş kaydı |
| Jahr der Erstsichtung | 2012 |
| Andere Namen | Bladabindi |
Bedrohungsindikatoren (IOC)
- SHA256:
c706f26e9415008e1a59ae096932524bf0235a8fd003d476c2fb6a1684fa3070 - MD5:
54a357601a27f1d140a46df93f8ff3cf
Anleitung zur Systembereinigung
- Trennen Sie das System vom Netzwerk — Ethernet abziehen, WLAN deaktivieren
- Beenden Sie verdächtige Prozesse im Task-Manager
- Führen Sie einen vollständigen Systemscan mit Malwarebytes oder Kaspersky durch
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run kayıtlarını kontrol edin
- Prüfen Sie neu erstellte Aufgaben in der Aufgabenplanung
- Ändern Sie alle Kontopasswörter von einem sauberen Gerät aus
- Gerekirse Windows'u yeniden yükleyin ve verilerinizi temiz bir yedeğe geri alın
Hinweise für YARA-Regeln
rule NjRAT_SHA256 {
meta:
description = "NjRAT sample: c706f26e9415008e"
threat_level = "high"
first_seen = "2026-03-01"
condition:
hash.sha256(0, filesize) == "c706f26e9415008e1a59ae096932524bf0235a8fd003d476c2fb6a1684fa3070"
}NjRAT — Malware-Profil
njRAT Bladabindi. Spanish cotizacion lure. get_Panel1 C2 panel. MENA + Latin America targeting.
Malware-Typ
RAT
Programmiersprache
VB.NET
C2-Protokoll
TCP (varsayilan port 1177)
Zielsysteme
Windows
Auch bekannt als (AKA)
Bladabindi, H-Worm, houdini
Technische Details
TCP port 1177 (varsayilan), XOR tabanlı iletisim sifreleme, .NET Framework 2.0+, Mutex: {GUID}, Registry Run key persistence, Keylogger (GetAsyncKeyState), clipboard monitor, screenshot, remote shell, remote camera
Attribution / Bedrohungsakteur
Arap dilli siber suc topluluklari, en cok MENA (Orta Dogu ve Kuzey Afrika) bolgesindeki gruplar. Yasama savasi donemi Suriyeli gruplar tarafindan da kullanilmistir.
Fähigkeiten & Verhalten
Uzaktan Erişim & Kontrol
Keylogger
Ekran Görüntüsü
Webcam Erişimi
Dosya Yönetimi
Süreç Yönetimi
Komut Yürütme
Kalıcılık Mekanizması
IOC-Liste (25 Indikatoren)
IOC — NjRAT
# SHA256
c706f26e9415008e1a59ae096932524bf0235a8fd003d476c2fb6a1684fa3070
# MD5
54a357601a27f1d140a46df93f8ff3cf
# IP
185.176.27.250
# IP
146.70.124.85
# IP
62.197.162.218
# IP
92.204.160.114
# IP
5.252.22.90
# IP
91.215.85.53
# IP
185.252.148.78
# IP
91.121.146.89
# DOMAIN
njrat-c2-2025.ddns.net
# DOMAIN
bloopblast.no-ip.biz
# DOMAIN
njstudio.myftp.biz
# DOMAIN
njrat-builder-online.ru
# MUTEX
5XmUuN0Gzh_mutex
# MUTEX
njrat_unique_2kxpw3
# MUTEX
e
# MUTEX
Hacked
# REGISTRY
HKCUSoftwareMicrosoftWindowsCurrentVersionRun
j
# REGISTRY
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun
j
# REGISTRY
HKCUSoftwareMicrosoftWindowsCurrentVersionRunHost Process
# FILEPATH
%TEMP%server.exe
# FILEPATH
%APPDATA%MicrosoftWindowsStart MenuProgramsStartup[random].exe
# FILEPATH
%APPDATA%RoamingWindows Host Processwinhostservice.exe
# EMAIL
njrat-builder@protonmail.com
| Typ | Wert | Bemerkung |
|---|---|---|
| sha256 | c706f26e9415008e1a59ae096932524bf0235a8fd003d476c2fb6a1684fa3070 | |
| md5 | 54a357601a27f1d140a46df93f8ff3cf | |
| ip | 185.176.27.250 | C2:1177 |
| ip | 146.70.124.85 | C2:5552 |
| ip | 62.197.162.218 | C2:4444 |
| ip | 92.204.160.114 | C2:1177 |
| ip | 5.252.22.90 | NjRAT aktif C2 |
| ip | 91.215.85.53 | NjRAT C2 Rusya |
| ip | 185.252.148.78 | C2:9090 |
| ip | 91.121.146.89 | C2:9999 |
| domain | njrat-c2-2025.ddns.net | NjRAT dynamic DNS C2 |
| domain | bloopblast.no-ip.biz | NjRAT No-IP free DNS C2 |
| domain | njstudio.myftp.biz | NjRAT FTP-style DNS C2 |
| domain | njrat-builder-online.ru | NjRAT builder satis sitesi |
| mutex | 5XmUuN0Gzh_mutex | NjRAT Lime Edition 2025 mutex |
| mutex | njrat_unique_2kxpw3 | NjRAT standart mutex - VB string literal |
| mutex | e | NjRAT default mutex |
| mutex | Hacked | NjRAT Hacked mutex |
| registry | HKCUSoftwareMicrosoftWindowsCurrentVersionRun j | NjRAT autorun key |
| registry | HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun j | NjRAT system autorun |
| registry | HKCUSoftwareMicrosoftWindowsCurrentVersionRunHost Process | NjRAT persistence - host process taklidi |
| filepath | %TEMP%server.exe | NjRAT common drop path |
| filepath | %APPDATA%MicrosoftWindowsStart MenuProgramsStartup[random].exe | NjRAT startup persistence |
| filepath | %APPDATA%RoamingWindows Host Processwinhostservice.exe | NjRAT sahte Windows process |
| njrat-builder@protonmail.com | NjRAT builder e-posta |
C2-Server (8 erfasste Server für diese Familie)
| Adresse | Typ | Port | Protokoll | Status | Land |
|---|---|---|---|---|---|
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| comodoca.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| comodoca.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
C2-Adressen stammen ausschließlich aus vom KEYDAL-Team manuell verifizierten Malware-Samples. Kommerzielle Nutzung ist untersagt.