Njrat

Overview

njRAT is a remote access tool (RAT) that, per MITRE ATT&CK, was first observed in 2012 and has been used by threat actors in the Middle East and more broadly. Because its builder tools circulated widely, it has been adopted by a large range of low- to mid-tier actors. It gives an attacker remote control of an infected machine, including keylogging, credential theft, file access, and webcam/microphone access. It is also tracked under the detection name Bladabindi.

Known aliases

Threat reports may refer to this family under multiple names:

• njRAT
• Bladabindi
• Njw0rm
• LV

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1056.001 T1547.001 T1071.001

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.
• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_NJRAT {
    meta:
        description = "Detects Njrat (rat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "njrat" ascii wide nocase
        $s2 = "njrat" ascii wide nocase
        $s3 = "bladabindi" ascii wide nocase
        $s4 = "njw0rm" ascii wide nocase
        $s5 = "lv" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Njrat Activity
id: fec90de40e9289d63ad246033ef5f1d5
status: experimental
description: Detects generic indicators of the njrat malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*njrat*"
            - "*njrat*"
            - "*bladabindi*"
            - "*njw0rm*"
            - "*lv*"
    condition: selection
level: medium

References & External Analysis

• MITRE ATT&CK: njRAT (S0385)
• Search "njrat" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: rat)

Explore other malware families in the same category:

• Spygate
• Lolbot
• Nanobot
• Hupigon
• Remcos

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/njrat.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.