#Njrat

Long-running .NET commodity RAT, especially active in MENA campaigns

Subscribe (RSS)


#Njrat

Commodity .NET RAT, especially active in MENA

Subscribe (RSS)

IOCs by window

Today

0

IOCs tagged #Njrat

Week

0

IOCs tagged #Njrat

Month

0

IOCs tagged #Njrat

Year

176

IOCs tagged #Njrat

Counts as of 2026-10-29. Regenerated daily.

About #Njrat

  • Type: Commodity .NET Remote Access Trojan. Also called Bladabindi.
  • Forks: Builder leaked years ago. Many forks and variants.
  • Spread: Especially MENA: Arabic phishing, fake game cheats, Discord loaders.
  • Abilities: Keylogging, screen capture, file management, USB spread, remote shell.
  • Signals: TCP C2 on port 5552 (default). Run key persistence. Mutex starts with Stub.
  • References: MITRE ATT&CK S0385 · Malpedia.

Recent IOCs tagged #Njrat

No IOCs tagged #Njrat in the past 30 days. Year total: 176. Older data: api.tweetfeed.live/v1/year (all tags, filter for #Njrat).

Related tags

Often seen with #Njrat.

See all tags on the Dashboard or browse the full IOC feed.

Frequently asked questions

What is njRAT?

A long-running .NET commodity Remote Access Trojan, also called Bladabindi, tracked by MITRE as S0385. It does keylogging, screen capture and remote shell.

Where does njRAT activity concentrate?

Especially in MENA campaigns: Arabic phishing, fake game cheats and Discord loaders. It also appears in opportunistic global campaigns.

How is this list updated?

The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.

What is the license? Can I use this commercially?

Yes. All IOC data, including this Njrat subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.

License

Njrat IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.