NjRAT (Bladabindi) Technical Intelligence Dossier

Executive Summary & Threat Architecture

njRAT (also tracked as Bladabindi, Njw0rm, and Backdoor:MSIL/Bladabindi) is a notorious, widely disseminated remote access trojan (RAT) developed in Microsoft Visual Basic .NET by a Kuwaiti threat actor known as 'njq8'. First surfacing in 2012 and publicly distributed across underground forums, njRAT became one of the most widespread commodity remote administration tools in the Middle East and worldwide. njRAT establishes persistent reverse TCP socket connections to operator command-and-control servers, utilizing dynamic DNS domains and communicating via custom plaintext protocols delimited by the string '|'|'|'. The trojan provides operators with extensive interactive surveillance and administrative control: it features real-time keystroke logging via the GetAsyncKeyState Windows API, live desktop screen streaming, webcam and microphone spying, arbitrary process execution via cmd.exe and PowerShell, file system manipulation, and automated credential theft from web browsers, FileZilla, and instant messaging clients. To evade detection, njRAT executes process hollowing (T1055.012) into trusted Windows processes (such as svchost.exe), modifies firewall rules via netsh, and adds itself to registry autostart keys. In June 2014, Microsoft and the FBI executed a landmark civil and criminal operation, seizing 22 dynamic DNS domains managed by No-IP (Vitalwerks) that were actively facilitating njRAT and Bladabindi botnets, accompanied by CISA Alert AA14-143A.

Observed Threat Aliases: Bladabindi, Njw0rm, Backdoor:MSIL/Bladabindi, Trojan.MSIL.njRAT, Win32/Bladabindi

Ancestry & Lineage Tracking

Derived From / Upstream Ancestry: Proprietary origin

Documented Downstream Variants: njrat_v0.7d, njw0rm, bladabindi

Weaponized Vulnerabilities & Exploitation Topology

Documented common vulnerabilities and exposures (CVEs) weaponized by NjRAT (Bladabindi) operators for initial execution, sandbox evasion, or SYSTEM-level kernel privilege escalation:

→ Explore all 77 exploited vulnerabilities on the SystemHelpDesk CVE Threat Matrix Hub.

MITRE ATT&CK® Tactical Tradecraft

Tactics, techniques, and procedures (TTPs) systematically mapped across real-world intrusion kill-chains:

→ Inspect the complete 226-technique matrix on the MITRE ATT&CK Defense Hub.

Indicators of Compromise (IOCs) & Forensic Artifacts

Curated indicators for retrospective threat hunting across SIEM and EDR platforms:

Initial Delivery Vectors

• Malicious spam emails delivering weaponized Office documents exploiting CVE-2017-11882
• Spear-phishing archives with embedded LNK shortcuts or executable screensavers (.scr)
• P2P file sharing networks hosting cracked software and keygens bundled with njRAT

Host Persistence & Execution Hooks

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run entry pointing to dropped .NET executable
• Startup folder shortcut under %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
• Process injection into svchost.exe to conceal running processes

Reference File Hashes (SHA-256)

• 4ffc186835a74659f170423c91465d3ec62b1e7c53d51786ce45464fb5f4581d
• 1bc7ee24bf3692e8fa4c3f56ebc5970c40cebf656a1bce47b74f391152a4e98f