Achieved 100% detection in 2023
Stop advanced cyber
threats with one solution
Cynet’s All-In-One Security Platform
- Full-Featured EDR and NGAV
- Anti-Ransomware & Threat Hunting
- 24/7 Managed Detection and Response
nJRAT Report: Bladabindi
August 10, 2020
Last Updated:
November 27, 2024
Share on:
Written by: Eran Yosef
njRAT is a variant of jRAT, which is also called Bladabindi; it is a remote access trojan used to control infected machines remotely. Because of its availability and its techniques, njRAT is one of the most widely used RATs in the world – first detected in 2013.
The njRAT trojan is built on the .NET framework. This RAT gives hackers the ability to control the victim’s PC remotely. njRAT allows attackers to activate the webcam, log keystrokes, and steal passwords from web browsers.
Also, Bladabindi gives hackers access to the command line on the infected machine. It allows the malicious actor to kill processes as well as remotely execute and manipulate files. On top of that, njRAT is capable of manipulating the system registry. When a PC is infected, Bladabindi Trojan will collect several bits of information about the PC that it got into, including the name of the computer, operating system number, country of the computer, usernames, and OS version.
Moreover, Bladabindi can target cryptocurrency wallet applications and steal cryptocurrency from PCs. For example, it can grab a bitcoin wallet and access credit card information, which is usually stored in cryptocurrency apps as a way to purchase cryptocurrency.
After infecting a computer, the malware copies into “TEMP,” “APPDATA,” “USERPROFILE.”
It can also copy itself into .exe files, to ensure that it will be activated every time the victim switches on their computer.
The njRAT trojan has a few tricks up its sleeve to avoid detection by antivirus softwares. For example, it uses multiple .NET obfuscators to obstruct its code. Another technique that this malware uses is disguising itself into a critical process, blocking the user’s ability to shut it down, making njRAT hard to remove from infected PCs. Bladabindi RAT can also deactivate processes that belong to antivirus softwares, allowing it to stay hidden. njRAT also knows how to detect if it is running on a virtual machine, which helps the attackers to set up countermeasures against researchers.
For spreading, njRAT can detect external hard drives connected via USB. Once such a device is detected, the RAT will copy itself onto the connected drive and create a shortcut.
This is part of an extensive series of guides about Malware Protection
Cynet Detections:
Server.exe
Stop advanced cyber
Rated 4.8/5
2024 Leader
Alert Description:
Anti-Virus/AI Mechanism – Detection Wngine
The “Detection Engine” alerts refer to any alert generated by Cynet’s Next-Gen Antivirus or by Cynet’s machine learning mechanism.
- Detection Engine – Malicious Binary – Infected File- File Dumped on the Disk
This alert triggers when Cynet’s AV/AI engine detects a malicious file that was dumped on the disk.
- Detection Engine – Malicious Binary – Infected File- Attempt to Run –
The alert triggers when Cynet’s AV/AI engine detects a malicious file that was loaded to the memory.
Threat Intelligence Detection – Malicious Binary – Blacklist – Fast Scan Mechanism
This type of alert is based on the Cynet’s threat intelligence database, which contains millions of IoCs. The feed of our threat intelligence database includes third-party information (such as VirusTotal) as well as information derived from attack investigations and pre-defined suspicious patterns and auto-analysis of large, intricate patterns. This alert triggers when Cynet detects a file that is flagged as malicious in Cynet’s internal threat intelligence database.
Malicious Binary – ADT Mechanism
This alert triggers when Cynet detects a file that is flagged as malicious in Cynet’s EPS (endpoint scanner) built-in threat intelligence database. This database contains only critical IoCs (such as IOCs of ransomware, hacking tools, etc.).
Creation & Flow:
Once we first open njRAt, it asks us to choose the port we want the software to listen to. [We selected 4444]
After this, we need to build our “server” file.
We created a .exe file that will open a remote connection to the victim’s machine.
Choose the following:
- Host IP and the port
- Victim name
- Size key
- Directory to save
- Exe name you want to give the server
- There are also a few marks options you can use:
- Icon – choose Icon
- Protected process – means the server process will be undeletable from the registry.
- Copy to start up [ persistency on the machine]
- Registry start-up
- If chosen, the registry start-up will create a key with the name [kl] into the path
HKEY_CURRENT_USER\Software\32 characters and digits, you can be sure that is njRAT.
As you’ve entered all the information you want, hit the “build” button, and it creates the .exe file.
Now, we need to deliver the server file to our victim.
The njRAT trojan uses quite a few attack vectors to infect its victims. For example, the malware is known to target Discord users as part of spam campaigns. Another method is through a compromised website that tricks users into downloading a fake software product update, which in turn installs the njRAT malware to the PC.
Once we deliver njRAT to our victim, and it infected the target device, the malware starts its malicious activity.
A note will pop up in the victim machine and then all the options we will be available to us.
Proof of Concept:
If we want a remote desktop connection to the victim machine – we press remote desktop, and then it will open a window with access:
To gather passwords from the web browser of the victim machine – we press get the password:
If we want to open a file on the remote victim, press on Run file and explorer will open to choose a file to run.
There are a few more options like:
- Open Folder
- KeyLogger
- Microphone
- Camera
MITRE ATT&CK description:
“njRAT is a remote access tool (RAT) that was first observed in 2012. It has been used by threat actors in the Middle East.”
Stop advanced cyber
threats with one solution
Cynet’s All-In-One Security Platform
- Full-Featured EDR and NGAV
- Anti-Ransomware & Threat Hunting
- 24/7 Managed Detection and Response
Achieved 100% detection in 2023
Rated 4.8/5
2024 Leader
Techniques Used
Application Window Discovery
njRAT gathers information about opened windows during the initial infection.
Command-Line Interface
njRAT can launch a command shell interface for executing commands.
Credentials from Web Browsers
njRAT has a module that steals passwords saved in victim web browsers.
Custom Command and Control Protocol
njRAT communicates to the C2 server using a custom protocol over TCP.
Data Encoding
njRAT uses Base64 encoding for C2 traffic.
Data from Local System
njRAT can collect data from a local system.
Disabling Security Tools
njRAT has modified the Windows firewall to allow itself to communicate through the firewall.
File and Directory Discovery
njRAT can browse file systems using a file manager module.
File Deletion
njRAT is capable of deleting files on the victim
Input Capture
njRAT is capable of logging keystrokes.
Modify Registry
njRAT can create, delete, or modify a specified Registry key or value.
Peripheral Device Discovery
njRAT will attempt to detect if the victim system has a camera during the initial infection.
Registry Run Keys / Startup Folder
njRAT has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\.
Remote Desktop Protocol
njRAT has a module for performing remote desktop access.
Remote File Copy
njRAT can upload and download files to and from the victim’s machine.[1]
Remote System Discovery
njRAT can identify remote hosts on connected networks.
Replication Through Removable Media
njRAT can be configured to spread via removable drives.
Screen Capture
njRAT can capture screenshots of the victim’s machines.
System Information Discovery
njRAT enumerates the victim’s operating system and computer name during the initial infection.
System Owner/User Discovery
njRAT enumerates the current user during the initial infection.
Uncommonly Used Port
njRAT has been observed communicating over uncommon TCP ports
Video Capture
njRAT can access the victim’s webcam.
IOC'S:
We have uploaded the “server” file to VT:
njRAT on VT:
| File
SHA256 |
Server-aedb5b5a2dcb788f2474f929173151db8eb6d7489b00c85e7303755cfd7a59ef
njRAT- bf853789b938bdc5da8aaeb52511379a332c7cf238266a21bfcb0318a62e85cb |
RECOMMENDATIONS:
To clean up an infected host, it crucial to revert each of the steps taken by the payload of the attack.
• Clean the Registry for any of the manipulated values.
• Delete Malicious Child’s instances from the memory.
• Block Network Traffic to any domain contacted throughout the attack.
• Use Cynet’s built-in remediation options to delete the file and prevent f it from spreading over the network.
• Use Cynet’s built-in remediation option to disconnect the HOST from the network.
• Investigate the incident according to the organization’s policy.
Tips From the Expert
In my experience, here are tips that can help you better defend against njRAT (Bladabindi) and similar remote access trojans:
- Deploy Strict USB Device Controls: Restricting the use of USB devices and scanning inserted devices for malware helps prevent njRAT and other malware from spreading through removable media.
- Monitor for Unusual Registry Activity: Keeping an eye on registry changes for suspicious activity helps identify and block persistence mechanisms used by njRAT.
- Leverage Sandbox Detonation: Executing suspicious files in an isolated sandbox environment allows for safe analysis and detection of malicious code before it can infect the network.
- Track Anomalies in External IP Traffic: Monitoring network traffic for unusual or unexpected connections can help identify C2 communications used by njRAT.
- Use Software Restriction Policies: Restricting executable files from running in common njRAT persistence directories makes it harder for the malware to establish persistence and execute upon system reboot.
These advanced tactics will help reduce the risk of njRAT infections and improve detection capabilities within your organization.
CONTACT CYNET CYOPS (CYNET SECURITY OPERATIONS CENTER)
The Cynet CyOps is available to clients for any issues 24/7, questions, or comments related to Cynet 360. For additional information, you may contact us directly at:
- Phone (US): +1-347-474-0048
- Phone (EU): +44-203-290-9051
- Phone (IL): +972-72-336-9736
- CyOps Email: [email protected]
