Trend Micro njRAT 2018

njRAT can read specific registry values.

njRAT has used AutoIt to compile the payload and main script into a single executable after delivery.

njRAT has included a base64 encoded executable.

njRAT has used C2 infrastructure to receive stolen information from the infected machine including screenshots and other system information.

njRAT is capable of logging keystrokes.

njRAT can search a list of running processes for Tr.exe.

njRAT has executed PowerShell commands via auto-run registry key persistence.

njRAT is capable of deleting files.

njRAT is capable of manipulating and deleting registry keys, including those used for persistence.

njRAT has used HTTP for C2 communications.

njRAT can be configured to spread via removable drives.

njRAT can download files to the victim’s machine. APT-C-36 has used modified versions of njRAT to enable the download of .NET assemblies.

njRAT has used the ShellExecute() function within a script.

njRAT can create, delete, or modify a specified Registry key or value.

njRAT can capture screenshots of the victim’s machines.

njRAT will attempt to detect if the victim system has a camera during the initial infection. njRAT can also detect any removable drives connected to the system.

njRAT has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\ and dropped a shortcut in %STARTUP%.

njRAT has a module that steals passwords saved in victim web browsers.

njRAT has used a fast flux DNS for C2 IP resolution.

njRAT has used port 1177 for HTTP C2 communications.

njRAT has modified the Windows firewall to allow itself to communicate through the firewall.