Procedure examples

njRAT can collect data from a local system.

njRAT gathers information about opened windows during the initial infection.

njRAT can read specific registry values.

njRAT can identify remote hosts on connected networks.

njRAT has a module for performing remote desktop access.

njRAT has used AutoIt to compile the payload and main script into a single executable after delivery.

njRAT has included a base64 encoded executable.

njRAT enumerates the current user during the initial infection.

njRAT has used C2 infrastructure to receive stolen information from the infected machine including screenshots and other system information.

njRAT is capable of logging keystrokes.

njRAT can search a list of running processes for Tr.exe.

njRAT has executed PowerShell commands via auto-run registry key persistence.

njRAT can launch a command shell interface for executing commands.

njRAT is capable of deleting files.

njRAT is capable of manipulating and deleting registry keys, including those used for persistence.

njRAT has used HTTP for C2 communications.

njRAT enumerates the victim operating system and computer name during the initial infection.

njRAT can browse file systems using a file manager module.

njRAT can be configured to spread via removable drives.

njRAT can download files to the victim’s machine. APT-C-36 has used modified versions of njRAT to enable the download of .NET assemblies.

njRAT has used the ShellExecute() function within a script.

njRAT can create, delete, or modify a specified Registry key or value.

njRAT can capture screenshots of the victim’s machines.

njRAT will attempt to detect if the victim system has a camera during the initial infection. njRAT can also detect any removable drives connected to the system.

njRAT can access the victim's webcam.

njRAT uses Base64 encoding for C2 traffic.

njRAT has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\ and dropped a shortcut in %STARTUP%.

njRAT has a module that steals passwords saved in victim web browsers.

njRAT has used a fast flux DNS for C2 IP resolution.

njRAT has used port 1177 for HTTP C2 communications.

njRAT has modified the Windows firewall to allow itself to communicate through the firewall.