njRAT
njRAT is a remote access tool (RAT) that was first observed in 2012. It has been used by threat actors in the Middle East.[1]
Associated Software Descriptions
Name | Description |
---|---|
Njw0rm |
Some sources have discussed Njw0rm as a later variant of njRAT, where Njw0rm adds the ability to spread via removable devices such as USB drives.[2] Other sources contain that functionality in their description of njRAT itself.[1][3] |
LV | |
Bladabindi |
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols | |
Enterprise | T1010 | Application Window Discovery |
njRAT gathers information about opened windows during the initial infection.[1] |
|
Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
njRAT has added persistence via the Registry key |
Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
njRAT can launch a command shell interface for executing commands.[1] |
.001 | Command and Scripting Interpreter: PowerShell |
njRAT has executed PowerShell commands via auto-run registry key persistence.[3] |
||
Enterprise | T1555 | .003 | Credentials from Password Stores: Credentials from Web Browsers |
njRAT has a module that steals passwords saved in victim web browsers.[1][3][4] |
Enterprise | T1132 | .001 | Data Encoding: Standard Encoding | |
Enterprise | T1005 | Data from Local System | ||
Enterprise | T1568 | .001 | Dynamic Resolution: Fast Flux DNS | |
Enterprise | T1041 | Exfiltration Over C2 Channel |
njRAT has used HTTP to receive stolen information from the infected machine.[3] |
|
Enterprise | T1083 | File and Directory Discovery |
njRAT can browse file systems using a file manager module.[1] |
|
Enterprise | T1562 | .004 | Impair Defenses: Disable or Modify System Firewall |
njRAT has modified the Windows firewall to allow itself to communicate through the firewall.[1][3] |
Enterprise | T1070 | Indicator Removal on Host |
njRAT is capable of deleting objects related to itself (registry keys, files, and firewall rules) on the victim.[1][3] |
|
Enterprise | T1105 | Ingress Tool Transfer | ||
Enterprise | T1056 | .001 | Input Capture: Keylogging | |
Enterprise | T1112 | Modify Registry |
njRAT can create, delete, or modify a specified Registry key or value.[1][3] |
|
Enterprise | T1106 | Native API |
njRAT has used the ShellExecute() function within a script.[3] |
|
Enterprise | T1571 | Non-Standard Port | ||
Enterprise | T1027 | Obfuscated Files or Information | ||
.004 | Compile After Delivery |
njRAT has used AutoIt to compile the payload and main script into a single executable after delivery.[3] |
||
Enterprise | T1120 | Peripheral Device Discovery |
njRAT will attempt to detect if the victim system has a camera during the initial infection. njRAT can also detect any removable drives connected to the system.[1][3] |
|
Enterprise | T1057 | Process Discovery | ||
Enterprise | T1012 | Query Registry | ||
Enterprise | T1021 | .001 | Remote Services: Remote Desktop Protocol | |
Enterprise | T1018 | Remote System Discovery | ||
Enterprise | T1091 | Replication Through Removable Media |
njRAT can be configured to spread via removable drives.[1][3] |
|
Enterprise | T1113 | Screen Capture | ||
Enterprise | T1082 | System Information Discovery |
njRAT enumerates the victim operating system and computer name during the initial infection.[1] |
|
Enterprise | T1033 | System Owner/User Discovery |
njRAT enumerates the current user during the initial infection.[1] |
|
Enterprise | T1125 | Video Capture |
Groups That Use This Software
ID | Name | References |
---|---|---|
G0078 | Gorgon Group | |
G0043 | Group5 | |
G0096 | APT41 |
References
- Fidelis Cybersecurity. (2013, June 28). Fidelis Threat Advisory #1009: "njRAT" Uncovered. Retrieved June 4, 2019.
- Dawda, U. and Villeneuve, N. (2013, August 30). Njw0rm - Brother From the Same Mother. Retrieved June 4, 2019.
- Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019.
- Scott-Railton, J., et al. (2016, August 2). Group5: Syria and the Iranian Connection. Retrieved September 26, 2016.
- Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.
- Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.