Sunday 2 February 2014

"njRAT", The Saga Continues



 In June 2013, we released a paper containing information about the njRAT malware that included its functionality, indicators of compromise, and campaign codes used on the variants we had identified.



To this day, we continue to observe waves of blunt phishing attacks from compromised hosts in the Middle East, showing threat actors using multiple tools (including njRAT, AdwindRAT, Xtreme RAT, and H-Worm) in clustered phishing attacks against the same targets.  Some of these attacks continue to target the U.S. telecommunications sector with threat actors sending phishing emails using business-oriented lures containing the aforementioned tools or links to websites that serve these tools.



Additionally, we continue to directly observe significant activity from threat actors sending commands to the victim systems in the Middle East.



Further, we are observing attackers using the following obfuscators to make detection of this malware specimen more difficult for security analysts:




Note:Try At Your Own Risk

















7 comments:

  1. Replies
    1. ha g Asim theak keh raha hai ye remote administrator tool hai...

      Delete
  2. es tool se aap kisi bhi computer ka complete data aur activity haasil kar sakty hen.Raja Asim (President)

    ReplyDelete
  3. Replies
    1. password is k under he likha howa hai
      ye hai password
      h4hacker

      Delete
  4. Hi All!

    I'm selling fresh & genuine SSN Leads, with good connectivity. All data is checked & verified.
    Headers in Leads:

    First Name | Last Name | SSN | Dob | Address | State | City | Zip | Phone Number | Account Number | Bank Name

    *You can ask for sample before any deal
    *Each lead will be cost $1
    *Premium Lead will be cost $5
    *If anyone wants in bulk I will negotiate
    *Sampling is just for serious buyers

    Hope for the long term deal
    For detailed information please contact me on:

    Whatsapp > +923172721122
    email > leads.sellers1212@gmail.com
    telegram > @leadsupplier
    ICQ > 752822040

    ReplyDelete