NjRAT | Threat Level: high | Type: RAT
Cryptographic Identifiers
| SHA256 | c706f26e9415008e1a59ae096932524bf0235a8fd003d476c2fb6a1684fa3070 |
|---|---|
| MD5 | 54a357601a27f1d140a46df93f8ff3cf |
| File Type | exe |
| Size | 953.0 KB |
| First Seen | 2026-03-01 |
| File Name | Not a rat.exe |
| Tags | exe, NjRAT |
Malware Family: NjRAT
NjRAT, Orta Doğu'da yaygın RAT'tır.
| Type | RAT |
|---|---|
| Programming Language | VB.NET |
| Target Platform | Windows |
| C2 Protocol | TCP |
| Purpose | Uzaktan erişim, tuş kaydı |
| First Seen Year | 2012 |
| Aliases | Bladabindi |
Threat Indicators (IOC)
- SHA256:
c706f26e9415008e1a59ae096932524bf0235a8fd003d476c2fb6a1684fa3070 - MD5:
54a357601a27f1d140a46df93f8ff3cf
System Cleanup Guide
- Disconnect the system from the network — unplug ethernet, disable Wi-Fi
- Terminate suspicious processes from Task Manager
- Run a full system scan with Malwarebytes or Kaspersky
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run kayıtlarını kontrol edin
- Review newly created tasks in Task Scheduler
- Change all your account passwords from a clean device
- Gerekirse Windows'u yeniden yükleyin ve verilerinizi temiz bir yedeğe geri alın
YARA Rule Hints
rule NjRAT_SHA256 {
meta:
description = "NjRAT sample: c706f26e9415008e"
threat_level = "high"
first_seen = "2026-03-01"
condition:
hash.sha256(0, filesize) == "c706f26e9415008e1a59ae096932524bf0235a8fd003d476c2fb6a1684fa3070"
}NjRAT — Malware Profile
njRAT Bladabindi. Spanish cotizacion lure. get_Panel1 C2 panel. MENA + Latin America targeting.
Malware Type
RAT
Programming Language
VB.NET
C2 Protocol
TCP (varsayilan port 1177)
Target Systems
Windows
Also Known As (AKA)
Bladabindi, H-Worm, houdini
Technical Details
TCP port 1177 (varsayilan), XOR tabanlı iletisim sifreleme, .NET Framework 2.0+, Mutex: {GUID}, Registry Run key persistence, Keylogger (GetAsyncKeyState), clipboard monitor, screenshot, remote shell, remote camera
Attribution / Threat Actor
Arap dilli siber suc topluluklari, en cok MENA (Orta Dogu ve Kuzey Afrika) bolgesindeki gruplar. Yasama savasi donemi Suriyeli gruplar tarafindan da kullanilmistir.
Capabilities & Behavior
Uzaktan Erişim & Kontrol
Keylogger
Ekran Görüntüsü
Webcam Erişimi
Dosya Yönetimi
Süreç Yönetimi
Komut Yürütme
Kalıcılık Mekanizması
IOC List (25 indicators)
IOC — NjRAT
# SHA256
c706f26e9415008e1a59ae096932524bf0235a8fd003d476c2fb6a1684fa3070
# MD5
54a357601a27f1d140a46df93f8ff3cf
# IP
185.176.27.250
# IP
146.70.124.85
# IP
62.197.162.218
# IP
92.204.160.114
# IP
5.252.22.90
# IP
91.215.85.53
# IP
185.252.148.78
# IP
91.121.146.89
# DOMAIN
njrat-c2-2025.ddns.net
# DOMAIN
bloopblast.no-ip.biz
# DOMAIN
njstudio.myftp.biz
# DOMAIN
njrat-builder-online.ru
# MUTEX
5XmUuN0Gzh_mutex
# MUTEX
njrat_unique_2kxpw3
# MUTEX
e
# MUTEX
Hacked
# REGISTRY
HKCUSoftwareMicrosoftWindowsCurrentVersionRun
j
# REGISTRY
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun
j
# REGISTRY
HKCUSoftwareMicrosoftWindowsCurrentVersionRunHost Process
# FILEPATH
%TEMP%server.exe
# FILEPATH
%APPDATA%MicrosoftWindowsStart MenuProgramsStartup[random].exe
# FILEPATH
%APPDATA%RoamingWindows Host Processwinhostservice.exe
# EMAIL
njrat-builder@protonmail.com
| Type | Value | Note |
|---|---|---|
| sha256 | c706f26e9415008e1a59ae096932524bf0235a8fd003d476c2fb6a1684fa3070 | |
| md5 | 54a357601a27f1d140a46df93f8ff3cf | |
| ip | 185.176.27.250 | C2:1177 |
| ip | 146.70.124.85 | C2:5552 |
| ip | 62.197.162.218 | C2:4444 |
| ip | 92.204.160.114 | C2:1177 |
| ip | 5.252.22.90 | NjRAT aktif C2 |
| ip | 91.215.85.53 | NjRAT C2 Rusya |
| ip | 185.252.148.78 | C2:9090 |
| ip | 91.121.146.89 | C2:9999 |
| domain | njrat-c2-2025.ddns.net | NjRAT dynamic DNS C2 |
| domain | bloopblast.no-ip.biz | NjRAT No-IP free DNS C2 |
| domain | njstudio.myftp.biz | NjRAT FTP-style DNS C2 |
| domain | njrat-builder-online.ru | NjRAT builder satis sitesi |
| mutex | 5XmUuN0Gzh_mutex | NjRAT Lime Edition 2025 mutex |
| mutex | njrat_unique_2kxpw3 | NjRAT standart mutex - VB string literal |
| mutex | e | NjRAT default mutex |
| mutex | Hacked | NjRAT Hacked mutex |
| registry | HKCUSoftwareMicrosoftWindowsCurrentVersionRun j | NjRAT autorun key |
| registry | HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun j | NjRAT system autorun |
| registry | HKCUSoftwareMicrosoftWindowsCurrentVersionRunHost Process | NjRAT persistence - host process taklidi |
| filepath | %TEMP%server.exe | NjRAT common drop path |
| filepath | %APPDATA%MicrosoftWindowsStart MenuProgramsStartup[random].exe | NjRAT startup persistence |
| filepath | %APPDATA%RoamingWindows Host Processwinhostservice.exe | NjRAT sahte Windows process |
| njrat-builder@protonmail.com | NjRAT builder e-posta |
C2 Servers (8 recorded servers for this family)
| Address | Type | Port | Protocol | Status | Country |
|---|---|---|---|---|---|
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| comodoca.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| comodoca.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.