Summary: 2025/04/28 23:21
First reported date: 2015/01/23
Inquiry period : 2025/03/29 23:21 ~ 2025/04/28 23:21 (1 months), 48 search results
전 기간대비 42% 높은 트렌드를 보이고 있습니다.
전 기간대비 상승한 Top5 연관 키워드는 njRAT NetWireRC c&c C2 DDNS 입니다.
악성코드 유형 RAT Trojan 도 새롭게 확인됩니다.
기타 account Email photobucksglatplygg payment Password 등 신규 키워드도 확인됩니다.
njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information.
Interested attackers can even find tutorials on YouTube.
* 최근 뉴스기사 Top3:
ㆍ 2025/04/28 Decoding njRAT traffic with NetworkMiner
ㆍ 2025/04/17 “I sent you an email from your email account,” sextortion scam claims
ㆍ 2025/04/16 “I sent you an email from your email account,” sextortion scam claims
참고로 동일한 그룹의 악성코드 타입은 Remcos njRAT QuasarRAT 등 112개 종이 확인됩니다.
Trend graph by period
Related keyword cloud
Top 100Special keyword group
Top 5
Malware Family
Top 5
A malware family is a group of applications with similar attack techniques.
In this trend, it is classified into Ransomware, Stealer, RAT or Backdoor, Loader, Botnet, Cryptocurrency Miner.
Threat info
Last 5SNS
(Total : 45)njRAT c&c NetWireRC C2 DDNS vpn France
News
(Total : 3)NetWireRC njRAT Victim Email Trojan Password payment Cryptocurrency RAT Browser Phishing Malware target
| No | Title | Date |
|---|---|---|
| 1 | Decoding njRAT traffic with NetworkMiner - Netresec / Erik Hjelmvik / malpedia | 2025.04.28 |
| 2 | “I sent you an email from your email account,” sextortion scam claims - Malware.News | 2025.04.17 |
| 3 | “I sent you an email from your email account,” sextortion scam claims - Malwarebytes Labs | 2025.04.16 |
Additional information
| No | Title | Date |
|---|---|---|
| 1 | Employee monitoring app exposes users, leaks 21+ million screenshots - Malware.News | 2025.04.28 |
| 2 | Introducing XSIAM 3.0 - Malware.News | 2025.04.28 |
| 3 | Deploy Bravely with Prisma AIRS - Malware.News | 2025.04.28 |
| 4 | 2025 Cyber Resilience Research Discovers Speed of AI Advancing Emerging Attack Types - Malware.News | 2025.04.28 |
| 5 | Intel CEO Targets Change in Corporate Culture to Shape Up - Bloomberg Technology | 2025.04.28 |
| View only the last 5 | ||
| No | Title | Date |
|---|---|---|
| 1 | Blind Eagle: …And Justice for All - Malware.News | 2025.03.10 |
| 2 | Blind Eagle: …And Justice for All - Malware.News | 2025.03.10 |
| 3 | Blind Eagle: …And Justice for All - Malware.News | 2025.03.10 |
| 4 | Blind Eagle: …And Justice for All - Malware.News | 2025.03.10 |
| 5 | Undercover miner: how YouTubers get pressed into distributing SilentCryptoMiner as a restriction bypass tool - Malware.News | 2025.03.05 |
| View only the last 5 | ||
| No | Request | Hash(md5) | Report No | Date |
|---|---|---|---|---|
| 1 |  PropertyFiles_2025-04-21.exenjRAT backdoor Generic Malware Antivirus Malicious Library UPX PE File CAB OS Name Check MSOffice File PE32 OS Processor Check DLL | b4f9c6f50cc331920c86a36e83e6b9f6 | 59888 | 2025.04.24 |
| 2 |  Explerer.exenjRAT backdoor PE File .NET EXE PE32 | 7c27b7369ddd2a6e528b1103d6c252e3 | 59853 | 2025.04.22 |
| 3 |  njntos.exenjRAT backdoor PE File .NET EXE PE32 | b510120966ae2b95f96e34dffb58f277 | 59854 | 2025.04.22 |
| 4 |  VPN-Installer.exenjRAT backdoor Generic Malware Malicious Library Antivirus UPX PE File CAB PE32 MSOffice File OS Processor Check OS Name Check DLL | 5188e0fd775892a2bdd22429988ab955 | 59727 | 2025.04.21 |
| 5 |  BTC-Flasher.exenjRAT backdoor Generic Malware Malicious Library Antivirus UPX PE File CAB PE32 MSOffice File OS Processor Check OS Name Check DLL | cdc608f2170924fa6849c50369bf0ff9 | 59808 | 2025.04.21 |
| View only the last 5 | ||||
| Level | Description |
|---|---|
| warning | File has been identified by 21 AntiVirus engines on VirusTotal as malicious |
| watch | Creates known Upatre files |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates executable files on the filesystem |
| notice | Drops an executable to the user AppData folder |
| notice | One or more potentially interesting buffers were extracted |
| notice | Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation |
| notice | Resolves a suspicious Top Level Domain (TLD) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Queries for the computername |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
| info | Uses Windows APIs to generate a cryptographic key |
| Network | ET DNS Query to a *.top domain - Likely Hostile |
| No | Category | URL | CC | ASN Co | Date |
|---|---|---|---|---|---|
| 1 | c2 | http://45.83.207.17:6522/ | GB  | Clouvider Limited | 2025.04.22 |
| 2 | c2 | http://jvjv2044duck33.duckdns.org/ | TR  | Turk Telekom | 2025.04.22 |
| 3 | c2 | http://45.83.207.17:3158/ | GB | Clouvider Limited | 2025.04.21 |
| 4 | c2 | http://abolhb.com/ | RU  | 2025.04.21 | |
| 5 | c2 | http://54.169.93.143:10549/ | SG  | AMAZON-02 | 2025.04.11 |
| View only the last 5 | |||||
| No | URL | CC | ASN Co | Reporter | Date |
|---|---|---|---|---|---|
| 1 | https://raw.githubusercontent.com/virusstudiov64/rat/main/sdc.exe njRAT | US  | FASTLY | DaveLikesMalwre | 2025.04.28 |
| 2 | http://github.com/sohpierainxz/Fnaf-1/raw/refs/heads/main/fusca%20game.exe njRAT | US | MICROSOFT-CORP-MSN-AS-BLOCK | DaveLikesMalwre | 2025.04.28 |
| 3 | http://185.215.113.19//inc/OneDrive.exe njRAT | anonymous | 2025.04.26 | ||
| 4 | http://185.215.113.19//inc/Client_protected.exe njRAT | anonymous | 2025.04.26 | ||
| 5 | http://185.215.113.19//inc/PkContent.exe njRAT | anonymous | 2025.04.26 | ||
| View only the last 5 | |||||