Is There A New njRAT Out There?

The answer to this question is Yes and No (or Probably Not).

Recently, we noticed a heated debate among Arabic-speaking hackers regarding rumors about a new njRAT version, dubbed v0.8d. Some doubted the credibility of the report, cautioning that the new version was probably a fake that would infect everyone who tried to use it. They also claimed that the original njRAT programmer, njq8, had stopped updating it.

Notwithstanding, there is a tutorial with a download link that shows the features of the new version. The video was published on several YouTube accounts and some of them linked the new version to an unknown hacker called Naseer2012 (whose name is similar to njq8‘s real name). In addition, this new njRAT version has aroused interest among Portuguese-speaking hackers, raising assumptions that the njRAT v0.8d developer is actually “Ajnabi” (foreign in Arabic).

The allegedly new njRAT version piqued our curiosity, so we downloaded it from the tutorial. First, the GUI of the new version closely resembles njRAT v0.7d. In addition, our technical analysis revealed that it belongs to the njRAT malware family, based on its Imphash (hash based on portable executable imports that are the functions of the specific malware) and its network signature.

However, it does not have any unique capabilities that distinguish it from the old 0.7d version. Its capabilities, according to our technical analysis, are keylogging, remote shell, remote desktop, password recovery, registry manager, file manager, remote webcam, microphone control, download & execute and DDoS. Unlike njRAT v0.7d, this malware does not have any security features, other than change icon. It can be spread by USB.

njrat
njRAT v0.8d user interface

Notably, the fact that Naseer2012 thanks njq8 suggests it this not an official upgraded version of the njRAT malware developed by the original programmer.

njrat2
Naseer2012 thanks njq8

Since the source code of the worm version of the famous njRAT malware (Njw0rm) was leaked in May 2013, many hackers have developed new malware under different names with numerous capabilities, security features and propagation protocols. However, they all have a common behavior pattern, since they are based on the same source code. In addition, our technical analysis of different RAT malware samples that we detected during 2015 revealed that almost a dozen of them belong to the njRAT family.

So we can all relax as there is no new official njRAT version, but rather a new GUI and new technical indicators of another njRAT-based malware sample.

The following is a YARA rule based on our technical analysis:

rule njrat_08d
{
meta:
author = “SenseCy”
date = “23-12-2015”
description = “Njrat v0.8d”
sample_filetype = “exe”

strings:
$string0 = “U0VFX01BU0tfTk9aT05FQ0hFQ0tT” wide
$string1 = “netsh firewall delete allowedprogram” wide
$string2 = “netsh firewall add allowedprogram” wide
$string3 = “cmd.exe /k ping 0 & del” wide
$string4 = “&explorer /root,\”%CD%” wide
$string5 = “WScript.Shell” wide
$string6 = “Microsoft.VisualBasic.CompilerServices”
$string7 = “_CorExeMain”
$string8 = { 6d 73 63 6f 72 65 65 2e 64 6c 6c }

condition:
all of them
}

The following are technical indicators of njRAT v0.8d stub files that we created in our technical lab:

MD5: 2c7ab4b9bf505e9aa7205530d3241319
SHA1: 31112340c4f36c7153bef274f217726c75779eaf
MD5: 620c8dc42dcad7d8e72dd17ac2fa06a1
SHA1: d88907822d7d7f14347059ba0b85d9f7d50a6d7a


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s