NjRAT (Bladabindi): Forensic Reverse-Engineering & Architectural Dossier

{
  "compiler": "Microsoft Visual Basic .NET Compiler (vbc.exe) / Roslyn",
  "runtime": ".NET Common Language Runtime (CLR 2.0.50727 or 4.0.30319)",
  "binary_footprint": "Single executable PE32 (.NET assembly), typ. 25 KB - 85 KB uncompressed stub",
  "stub_size": "49,152 bytes (vanilla v0.7d stub payload)",
  "packer_obfuscation": "ConfuserEx, DeepSea, .NET Reactor, or bundled inside multi-stage AutoIt / VBScript / PowerShell loaders",
  "subsystem": "Windows GUI (Subsystem 2)",
  "entry_point_flow": "Main() in module A or OK -> Mutex check (avoid duplicate instances) -> Unpack internal settings -> Copy self to drop directory (%TEMP% or %APPDATA%) -> Registry Run key persistence installation -> Critical process watchdog activation (RtlSetProcessIsCritical) -> Connect() raw TCP socket loop to configured C2",
  "technical_summary": "NjRAT (also known as Bladabindi) is a legacy commodity Remote Access Trojan authored in Visual Basic .NET. Renowned for its ubiquity across cybercrime forums, the malware utilizes an unencrypted, pipe-delimited raw TCP socket protocol separating command tokens with the literal string \"|'|'|\". Operational capabilities include remote desktop streaming, microphone and webcam surveillance, keystroke logging, registry manipulation, USB drive worm propagation, and system watchdog protection enforcing BSOD on termination."
}

{
  "interface_type": "WinForms Desktop GUI Operator Application (njRAT v0.7d / Golden Edition)",
  "builder_tabs_options": [
    {
      "tab": "Connection Configuration",
      "options": [
        "Host: Dynamic DNS hostname (e.g., duckdns.org, no-ip.biz) or static IP address",
        "Port: TCP listening port (default: 5552, 1177)",
        "Victim Name (VN): Identifier string assigned to infected endpoints (e.g., 'HacKeD')",
        "Version (VR): Hardcoded campaign/version string (e.g., 'njRAT 0.7d')"
      ]
    },
    {
      "tab": "Installation & Persistence",
      "options": [
        "Install Dir: Drop directory selection (%TEMP%, %APPDATA%, %PROGRAMFILES%)",
        "Exe Name: Executable filename dropped on disk (e.g., server.exe, svchost.exe)",
        "Registry Key: Subkey name written into CurrentVersion\\Run",
        "Copy to Startup: Boolean toggle copying executable directly into Windows Startup folder"
      ]
    },
    {
      "tab": "Defense & Propagation Toggles",
      "options": [
        "Protect Process (BD): Invokes RtlSetProcessIsCritical to trigger BSOD if process is killed",
        "USB Spread: Enables background monitoring of WM_DEVICECHANGE to copy payload and autorun.inf to flash drives",
        "Anti-Process: Terminates taskmgr.exe, regedit.exe, and Wireshark if detected"
      ]
    }
  ],
  "config_struct_layout": [
    {
      "offset": "Field HH",
      "type": "string",
      "field": "OK.HH",
      "description": "C2 server hostname or IP address"
    },
    {
      "offset": "Field PO",
      "type": "int",
      "field": "OK.PO",
      "description": "C2 server listening port number"
    },
    {
      "offset": "Field VN",
      "type": "string",
      "field": "OK.VN",
      "description": "Victim identifier / campaign name"
    },
    {
      "offset": "Field VR",
      "type": "string",
      "field": "OK.VR",
      "description": "Client version string (e.g., 'njRAT 0.7d')"
    },
    {
      "offset": "Field RG",
      "type": "string",
      "field": "OK.RG",
      "description": "Registry subkey name for persistence"
    },
    {
      "offset": "Field DR",
      "type": "string",
      "field": "OK.DR",
      "description": "Drop directory environment variable name"
    },
    {
      "offset": "Field EXE",
      "type": "string",
      "field": "OK.EXE",
      "description": "Dropped executable filename"
    },
    {
      "offset": "Field BD",
      "type": "bool",
      "field": "OK.BD",
      "description": "Process protection boolean (True enables critical process watchdog)"
    }
  ],
  "payload_generation_flags": [
    "Compiler: Invokes in-memory CodeDOM compiler (Microsoft.VisualBasic.VBCodeProvider)",
    "Assembly Information Spoofing: Clones title, company, product, and version metadata from benign executables",
    "Icon Changer: Extracts and embeds custom icon resources into compiled stub"
  ],
  "operator_commands": [
    "ll: Initial registration beacon sending victim telemetry",
    "inf: Retrieves expanded system hardware, operating system, and uptime information",
    "kl: Synchronizes offline keystroke log buffer stored in memory or temp file",
    "rn: Downloads and executes payload from external URL or disk path",
    "up: Uploads binary file to victim filesystem",
    "dw: Downloads remote file from victim filesystem to operator console",
    "pr: Process manager command list (kill, suspend, refresh active tasks)",
    "CAP: Remote desktop capture request invoking GDI screen scrape",
    "un: Uninstalls client stub and deletes persistence registry keys"
  ],
  "interface_telemetry_analysis": "The operator interface provides an intuitive table view displaying connected bot nodes, geolocation flags, OS version, active window titles, and real-time screen capture feeds."
}

struct NjRAT_(Bladabindi)_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

{
  "injection_chain": "Native .NET Execution / Dropper: Executes dropped stub -> Copies payload to %TEMP%\\<EXE>.exe -> Creates registry Run entry -> P/Invokes ntdll!RtlSetProcessIsCritical(1, NULL, 0) -> Enters asynchronous TCP socket loop using System.Net.Sockets.TcpClient.",
  "ntapi_functions": [
    "ntdll!RtlSetProcessIsCritical",
    "user32!GetForegroundWindow",
    "user32!GetWindowTextA",
    "user32!GetAsyncKeyState",
    "user32!SetWindowsHookExW"
  ],
  "delimiter_protocol": "Pipe Delimiter Communication: Unlike modern structured serialization formats (MsgPack/JSON), NjRAT relies on raw string concatenation. The protocol uses the signature delimiter string \"|'|'|\" (hex: 7C 27 7C 27 7C). Parameter values (computer name, user name, OS, active window title) are individual Base64-encoded strings joined by this delimiter. Packets begin with an ASCII integer length prefix followed by a null byte (0x00).",
  "process_protection_watchdog": "Critical Process Protection: If the builder option 'BD' (Break Death) is enabled, the client imports ntdll.dll via P/Invoke and calls RtlSetProcessIsCritical(1, 0, 0). This marks the malware process as a critical system component. If an analyst or user terminates the process via Task Manager or taskkill, the Windows kernel triggers BugCheck 0xEF (CRITICAL_PROCESS_DIED), immediately crashing the operating system.",
  "usb_propagation_engine": "Removable Drive Worm: Implements a background thread listening for the Windows message WM_DEVICECHANGE (0x0219). When a removable volume (DBT_DEVICEARRIVAL) is mounted, NjRAT copies its executable to the root directory, marks it with hidden/system file attributes (attrib +h +s), and creates an autorun.inf file or disguised Windows shortcuts (.lnk) pointing to the dropped payload.",
  "anti_analysis": "Basic process scanner scanning running processes against hardcoded blacklists (taskmgr, wireshark, processhacker)."
}

Concrete technical breakdown of functional modules implemented in the NjRAT (Bladabindi) binary:

{
  "framing": "Packets are framed as: <length_in_ascii>\\x00<command>|'|'|<param1>|'|'|<param2>|'|'|...",
  "serialization": "String concatenation of Base64-encoded tokens separated by the literal delimiter |'|'|.",
  "handshake": "Client establishes raw TCP socket connection -> Sends registration packet: '<len>\\x00ll|'|'|<HWID_b64>|'|'|<User_b64>|'|'|<PC_b64>|'|'|<OS_b64>|'|'|<Cam_b64>|'|'|<VR_b64>|'|'|..' -> Server responds with commands.",
  "cryptography": "Unencrypted plaintext ASCII or trivial Base64 parameter encoding (no TLS or AES by default).",
  "packet_types": [
    "ll: Initial beacon and system identification frame",
    "inf: System hardware, uptime, and network interface summary",
    "kl: Keystroke log synchronization packet",
    "CAP: Compressed desktop screen capture image buffer"
  ],
  "traffic_signature": "Easily identifiable raw TCP traffic containing high recurrence of ASCII string |'|'| (7C 27 7C 27 7C)."
}

Indicators of compromise and forensic patterns recorded across laboratory triage: