[gherardus]

if the file is crypted it could not work on a vm.

[Ainan007]

Ask a MRT to analyze the download maybe they can find something?

Although, I downloaded njRAT from xVuln a month ago and nothing fishy came up when I downloaded it.

---

Now that I think about it...

That "I want to download malware" seems real fishy...

[supreme00.]

wich one did you download 0.7 or 0.6 , i've been using 0.7 and it's clean
edit:
njrat is fine theres no backdoor
https://malwr.com/analysis/MWViNTA5NmI2N...llOGI2ZmQ/

[lavic2001]

He could edit and post clear version.

[Ainan007]

Ooooo shit is getting fishy ;-;

[yhi00]

install a AV
& remove the rat & other malcious files

[supreme00.]

The link you included is an analysis that tells us that the executeable has a backdoor.
It drops the payload to the appdata folder and adds itself to startup.
It even has a botkiller.

https://i.imgur.com/pdRcJWW.png
https://i.imgur.com/8QPwcII.png
edit:
just seen
C:\DOCUME~1\User\LOCALS~1\Temp\njRAT v0.7d.INI
C:/DOCUME~1
C:/DOCUME~1/User
C:/DOCUME~1/User/LOCALS~1
C:/DOCUME~1/User/LOCALS~1/Temp
C:\WINDOWS\assembly\pubpol1.dat
but i recently got my computer scanned by a whitehat helper and he said it's clean
also mbam is working fine , checked my startups and looks like theres nothing

[supreme00.]

But u see that files are being dropped right?

they are .ini files and .dat i doubt it's a rat + no network activity check yourself
i had 1400$ btcs in my wallet for months now nothing happened

[supreme00.]

I seriously have no idea how these things work tbh. I wish I could analyze it myself. But I am totally dependent on third parties for it. and Many users are reporting it as malware now, not just me.

Many guys are saying they saw their webcam turn on/off after using njrat. Some are reporting problems with MBAM just like me.

you and them may have download a rat somewhere else my mbam is working fine and my webcam never opened
just gave a look at your posts and i see you have downloaded jwatch and amother thing

[Wieno]

What if his site got hacked and somebody putted his backdoored njrat as download.

[lavic2001]

Im 100% sure he did this. Just take a look:

(This post was last modified: 03-22-2015 04:12 PM by xVulnerable.

[supreme00.]

https://i.imgur.com/8pRVgeH.png
2.exe = vuln's download of 2 months ago
njrat.exe = vuln's 6 months old download
joker = joker's download
all three files have the same md5 and from the malwr's scan i made looks like there is no rat binded to it

[supreme00.]

there is more than 1 file in the rar, could you check each and every one of them please? ty

https://i.imgur.com/BDJTpAx.png
joker's rar file is 1300kb and vuln's one is 1200kb

[supreme00.]

What kinda proof are we talking about? Many users have posted some IP that this njRAT connects to as soon as it is installed. They have also posted stuff related to this RAT dropping files in APPdata. I am not a pro, I am just a guy, who wanted to see how njRAT worked. I have used DarkComet before, never faced such issues. And I dont blame people uselessly.

they are probs lying there is no way njrat is backdoored it doesn't drop anything nor it connects to an ip

[He B TeMy]

http://up.dev-point.com/downloadf-844b1a...1-rar.html

Here is supposedly the original RAT and it's .5mb less than the size of what we are getting here on HF!

That's only the size of an average DC stub, yey !

Anyway, just shit-posting here, have nothing to do with this and will never use it.