Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
RAT

njRAT

RAT 39 detections found

Also known as: Bladabindi, Njw0rm, LV, njw0rm

njRAT is a .NET-based remote access trojan first observed around 2012 that has been heavily used by threat actors operating in the Middle East and North Africa. It provides keylogging, credential theft, webcam access, remote shell, and worm-like propagation via removable media through its Njw0rm-derived module, and is typically delivered through phishing attachments and cracked/pirated software. Its leaked builder and source code have kept it in wide, low-cost criminal circulation for over a decade, with detections still reported by vendors as of 2025.

Detection & eradication references

Curated links to authoritative sources — MITRE ATT&CK, CISA advisories, law-enforcement takedown announcements, and vendor threat-intel writeups — for removal, remediation, and further technical detail. Sigma Watch does not publish its own removal steps here, since malware behavior and tooling change too fast for a static write-up to stay reliably accurate.

Detection rules

Source Rule Status Updated
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.fromhell .lv domain rev 1 2026-07-03
snort ET INFO DYNAMIC_DNS HTTP Request to a *.fromhell .lv domain rev 1 2026-07-03
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.fromhell .lv domain rev 1 2026-07-03
snort ET INFO DYNAMIC_DNS Query to a *.fromhell .lv domain rev 1 2026-07-03
splunk Regsvr32 Silent and Install Param Dll Loading production 2026-06-09
splunk Windows Njrat Fileless Storage via Registry production 2026-05-13
splunk Windows Admin Permission Discovery production 2026-05-13
splunk Windows Delete or Modify System Firewall production 2026-05-13
splunk Windows Executable in Loaded Modules production 2026-05-13
splunk Windows Modify Registry With MD5 Reg Key Name production 2026-05-13
splunk Windows Time Based Evasion production 2026-05-13
snort ET INFO DYNAMIC_DNS Query to a *.minecraft .id .lv Domain rev 2 2024-06-11
snort ET INFO DYNAMIC_DNS HTTP Request to a *.minecraft .id .lv Domain rev 2 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.serveris .id .lv Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.unix .id .lv Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.serveris .id .lv Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.minecraft .id .lv Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.minecraft .id .lv Domain rev 3 2024-06-11
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.unix .id .lv Domain rev 3 2024-06-11
suricata ET MALWARE Bladabindi/njrat CnC Checkin rev 3 2024-03-06
snort ET INFO DYNAMIC_DNS Query to a *.serveris .id .lv Domain rev 2 2023-03-02
snort ET INFO DYNAMIC_DNS HTTP Request to a *.serveris .id .lv Domain rev 2 2023-03-02
snort ET INFO DYNAMIC_DNS HTTP Request to a *.unix .id .lv Domain rev 2 2023-03-02
snort ET INFO DYNAMIC_DNS Query to a *.unix .id .lv Domain rev 2 2023-03-02
suricata ET MALWARE Bladabindi/njrat CnC Checkin rev 1 2021-09-13
snort ET TROJAN Bladabindi/njrat CnC Checkin rev 1 2021-09-13
suricata ET MALWARE njRAT Variant Outbound CnC Beacon rev 2 2019-09-28
suricata ET WORM W32/Njw0rm CnC Beacon rev 3 2019-07-26
snort ET TROJAN njRAT Variant Outbound CnC Beacon rev 1 2015-05-05
snort ET TROJAN Bladabindi/njrat CnC Checkin rev 2 2013-09-05
snort ET WORM W32/Njw0rm CnC Beacon rev 3 2013-08-31
yara HKTL_NET_GUID_njRAT — —
yara network_traffic_njRAT — —
yara win_exe_njRAT — —
yara njrat1 — —
yara Njrat — —
yara Njrat2 — —
yara HKTL_NET_NAME_RAT_NjRat_0_7d_modded_source_code — —
yara HKTL_NET_NAME_njRAT_0_7d_Stub_CSharp — —