Fidelis njRAT June 2013

njRAT can collect data from a local system.

njRAT gathers information about opened windows during the initial infection.

njRAT can identify remote hosts on connected networks.

njRAT has a module for performing remote desktop access.

njRAT enumerates the current user during the initial infection.

njRAT is capable of logging keystrokes.

njRAT can launch a command shell interface for executing commands.

njRAT is capable of deleting files.

njRAT enumerates the victim operating system and computer name during the initial infection.

njRAT can browse file systems using a file manager module.

njRAT can be configured to spread via removable drives.

njRAT can download files to the victim’s machine. APT-C-36 has used modified versions of njRAT to enable the download of .NET assemblies.

njRAT can create, delete, or modify a specified Registry key or value.

njRAT will attempt to detect if the victim system has a camera during the initial infection. njRAT can also detect any removable drives connected to the system.

njRAT can access the victim's webcam.

njRAT uses Base64 encoding for C2 traffic.

njRAT has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\ and dropped a shortcut in %STARTUP%.

njRAT has a module that steals passwords saved in victim web browsers.

njRAT has modified the Windows firewall to allow itself to communicate through the firewall.