The njRAT Family
Introduction
This page is part of my series: Inside Different Generations of RATs, and serves as a reference hub for navigating njRAT-related analysis articles.
It provides an overview of the njRAT family, including its major versions and known variants.
If you are interested in the full series, please refer to the linked page above.
This page will be continuously updated as new research is added.
njRAT
njRAT, also known as Bladabindi, is a remote access tool (RAT) with a graphical user interface that allows operators to control a victim’s machine. It was first found in June 2013 with some variants traced to November 2012.
It was reportedly developed by a hacking group called M38dHhM and was often used against targets in the Middle East.
njRAT has many versions, and numerous variants can be found online. One of the most famous versions is the Lime Edition.
Note: The origin of the name “Bladabindi” is unclear. One possible interpretation is that
balad (بلد)means “country” or “place” in Arabic. Combined with the author’s aliasnjq8, this may explain the naming of “njRAT”.
njRAT is also one of the RATs that inspired my project DuplexSpy.
The Underlying Mechanism
njRAT implements a simple plugins functionality. The controller application sends DLL files, each responsible for a specific feature, to the payload. The payload then loads it via Assembly.Load() and executes the function with specified parameters.
Variants
njRAT has become open-source since the version 0.7. There are numerous variants available on the internet.
However, some variants contain incomplete or defective features. In addition, some variants have built-in backdoor.
The njRAT Family
The timeline was inferred from a combination of compiler timestamps, online analysis reports, log artifacts, and the “About” panels of the controller applications.
While no official release dates exist, this reconstruction provides a reasonable approximation of the evolution of the njRAT family.
Note: Some RAT versions have minimal changes; therefore, certain nodes in the family tree may point to the same article. This is intentional. The table below lists all analyzed RAT versions and editions, with each article corresponding to a distinct version to maintain clarity and avoid overlap.
| RAT Version | Article |
|---|---|
| njRAT v0.7d | Analyzing njRAT v0.7d |
| njRAT v0.9d | Analyzing njRAT v0.9d |
| njRAT Lime/Green Edition | Analyzing njRAT Lime and Green Edition |
| njRAT v0.10d | Analyzing njRAT v0.10d |
| njRAT v0.8d | Analyzing njRAT v0.8d |
| njRAT Golden Edition | Analyzing njRAT Golden Edition |
| njRAT Korean Variants | Analyzing Several Korean Variants of the njRAT Family |
| njRAT Danger Edition 2017 | Analyzing njRAT Danger Edition 2017 |
| njRAT Danger Edition 2018 | Analyzing njRAT Danger Edition 2018 |
| njRAT Danger Edition 2020 | Analyzing njRAT Danger Edition 2020 |
| njRAT Other Variants (The End) | Analyzing Other Variants of the njRAT Family |
Many variants are derived from njRAT v0.7, making it a foundational version for understanding the evolution of this malware family. Therefore, analyzing v0.7 provides critical insights into the design patterns reused across later variants.
The variants can be broadly classified into two categories based on origin and development intent:
- Official versions: v0.7, v0.9, v0.10
- Modified / weaponized editions: Lime, Green, Danger, Golden, etc.
Most modified editions are derived from v0.7, inheriting its core architecture while introducing additional features such as DDoS, ransomware, or anti-analysis mechanisms.
Overall, the njRAT ecosystem demonstrates how a single leaked or shared codebase can evolve into a large family of variants through incremental modifications.
This makes njRAT not only a widely observed threat, but also a valuable case study for understanding malware evolution, code reuse, and variant proliferation in the wild.
Related Links
THANKS FOR READING
