NjRAT | Nivel de amenaza: high | Tipo: RAT
Identificadores criptográficos
| SHA256 | c706f26e9415008e1a59ae096932524bf0235a8fd003d476c2fb6a1684fa3070 |
|---|---|
| MD5 | 54a357601a27f1d140a46df93f8ff3cf |
| Tipo de archivo | exe |
| Tamaño | 953.0 KB |
| Primera detección | 2026-03-01 |
| Nombre de archivo | Not a rat.exe |
| Etiquetas | exe, NjRAT |
Familia de malware: NjRAT
NjRAT, Orta Doğu'da yaygın RAT'tır.
| Tipo | RAT |
|---|---|
| Lenguaje de programación | VB.NET |
| Plataforma objetivo | Windows |
| Protocolo C2 | TCP |
| Propósito | Uzaktan erişim, tuş kaydı |
| Año de primera detección | 2012 |
| Otros nombres | Bladabindi |
Indicadores de amenaza (IOC)
- SHA256:
c706f26e9415008e1a59ae096932524bf0235a8fd003d476c2fb6a1684fa3070 - MD5:
54a357601a27f1d140a46df93f8ff3cf
Guía de limpieza del sistema
- Desconecte el sistema de la red: desenchufe el ethernet, desactive el Wi-Fi
- Finalice los procesos sospechosos desde el Administrador de tareas
- Realice un análisis completo del sistema con Malwarebytes o Kaspersky
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run kayıtlarını kontrol edin
- Revise las tareas recién creadas en el Programador de tareas
- Cambie todas las contraseñas de sus cuentas desde un dispositivo limpio
- Gerekirse Windows'u yeniden yükleyin ve verilerinizi temiz bir yedeğe geri alın
Sugerencias de reglas YARA
rule NjRAT_SHA256 {
meta:
description = "NjRAT sample: c706f26e9415008e"
threat_level = "high"
first_seen = "2026-03-01"
condition:
hash.sha256(0, filesize) == "c706f26e9415008e1a59ae096932524bf0235a8fd003d476c2fb6a1684fa3070"
}NjRAT — Perfil del malware
njRAT Bladabindi. Spanish cotizacion lure. get_Panel1 C2 panel. MENA + Latin America targeting.
Tipo de malware
RAT
Lenguaje de programación
VB.NET
Protocolo C2
TCP (varsayilan port 1177)
Sistemas objetivo
Windows
También conocido como (AKA)
Bladabindi, H-Worm, houdini
Detalles técnicos
TCP port 1177 (varsayilan), XOR tabanlı iletisim sifreleme, .NET Framework 2.0+, Mutex: {GUID}, Registry Run key persistence, Keylogger (GetAsyncKeyState), clipboard monitor, screenshot, remote shell, remote camera
Atribución / Actor de amenaza
Arap dilli siber suc topluluklari, en cok MENA (Orta Dogu ve Kuzey Afrika) bolgesindeki gruplar. Yasama savasi donemi Suriyeli gruplar tarafindan da kullanilmistir.
Capacidades y comportamiento
Uzaktan Erişim & Kontrol
Keylogger
Ekran Görüntüsü
Webcam Erişimi
Dosya Yönetimi
Süreç Yönetimi
Komut Yürütme
Kalıcılık Mekanizması
Lista IOC (25 indicadores)
IOC — NjRAT
# SHA256
c706f26e9415008e1a59ae096932524bf0235a8fd003d476c2fb6a1684fa3070
# MD5
54a357601a27f1d140a46df93f8ff3cf
# IP
185.176.27.250
# IP
146.70.124.85
# IP
62.197.162.218
# IP
92.204.160.114
# IP
5.252.22.90
# IP
91.215.85.53
# IP
185.252.148.78
# IP
91.121.146.89
# DOMAIN
njrat-c2-2025.ddns.net
# DOMAIN
bloopblast.no-ip.biz
# DOMAIN
njstudio.myftp.biz
# DOMAIN
njrat-builder-online.ru
# MUTEX
5XmUuN0Gzh_mutex
# MUTEX
njrat_unique_2kxpw3
# MUTEX
e
# MUTEX
Hacked
# REGISTRY
HKCUSoftwareMicrosoftWindowsCurrentVersionRun
j
# REGISTRY
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun
j
# REGISTRY
HKCUSoftwareMicrosoftWindowsCurrentVersionRunHost Process
# FILEPATH
%TEMP%server.exe
# FILEPATH
%APPDATA%MicrosoftWindowsStart MenuProgramsStartup[random].exe
# FILEPATH
%APPDATA%RoamingWindows Host Processwinhostservice.exe
# EMAIL
njrat-builder@protonmail.com
| Tipo | Valor | Nota |
|---|---|---|
| sha256 | c706f26e9415008e1a59ae096932524bf0235a8fd003d476c2fb6a1684fa3070 | |
| md5 | 54a357601a27f1d140a46df93f8ff3cf | |
| ip | 185.176.27.250 | C2:1177 |
| ip | 146.70.124.85 | C2:5552 |
| ip | 62.197.162.218 | C2:4444 |
| ip | 92.204.160.114 | C2:1177 |
| ip | 5.252.22.90 | NjRAT aktif C2 |
| ip | 91.215.85.53 | NjRAT C2 Rusya |
| ip | 185.252.148.78 | C2:9090 |
| ip | 91.121.146.89 | C2:9999 |
| domain | njrat-c2-2025.ddns.net | NjRAT dynamic DNS C2 |
| domain | bloopblast.no-ip.biz | NjRAT No-IP free DNS C2 |
| domain | njstudio.myftp.biz | NjRAT FTP-style DNS C2 |
| domain | njrat-builder-online.ru | NjRAT builder satis sitesi |
| mutex | 5XmUuN0Gzh_mutex | NjRAT Lime Edition 2025 mutex |
| mutex | njrat_unique_2kxpw3 | NjRAT standart mutex - VB string literal |
| mutex | e | NjRAT default mutex |
| mutex | Hacked | NjRAT Hacked mutex |
| registry | HKCUSoftwareMicrosoftWindowsCurrentVersionRun j | NjRAT autorun key |
| registry | HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun j | NjRAT system autorun |
| registry | HKCUSoftwareMicrosoftWindowsCurrentVersionRunHost Process | NjRAT persistence - host process taklidi |
| filepath | %TEMP%server.exe | NjRAT common drop path |
| filepath | %APPDATA%MicrosoftWindowsStart MenuProgramsStartup[random].exe | NjRAT startup persistence |
| filepath | %APPDATA%RoamingWindows Host Processwinhostservice.exe | NjRAT sahte Windows process |
| njrat-builder@protonmail.com | NjRAT builder e-posta |
Servidores C2 (8 servidores registrados para esta familia)
| Dirección | Tipo | Puerto | Protocolo | Estado | País |
|---|---|---|---|---|---|
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| comodoca.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| comodoca.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
Las direcciones C2 se proporcionan únicamente a partir de muestras de malware verificadas manualmente por el equipo KEYDAL. Se prohíbe el uso comercial.