[Dafuq]

why dont you clear all you connections on shitty pc.. thne run it..
then do a netstat -an ?

All that is done, I am currently following the procedure of MRT on HF. Hoping to get this resolved. Else I will just format my pc.

[Lovesosa]

if heared more people get the problem a guy on skype told me thath hes webcam lights has been going on and off.

[Mr. Money™]

I download the rat to and everything on my pc is fine.

What you could do is run a botkill and see if the (If there is a backdoor) Get's removed. Another thing you could do is create a new account on your computer and run the file on that account to and see if anything strange happends if not then it might have been another file causing this!

[SIM-2212192]

o shit
If this is true, xvunerable has a pretty bigass botnet, and you can only imagine how many bots he would have if he coded in some kind of bot-stealer.

I have it downloaded in a ratting VM, so I wouldn't really care as I don't have anything valuable there.

[Dafuq]

I'm sure some people are already analyzing it.
I don't have a test machine currently (my laptop is broken) so I can't really do a full analysis.
I checked it a little on my main machine and it doesn't look too fishy.

I'm unable to find anything regarding this connection.

I am not a Malware Analyzer, so cant really comment on this.

---

if heared more people get the problem a guy on skype told me thath hes webcam lights has been going on and off.

I have heard the same from many now. Via this thread.

---

I download the rat to and everything on my pc is fine.

What you could do is run a botkill and see if the (If there is a backdoor) Get's removed. Another thing you could do is create a new account on your computer and run the file on that account to and see if anything strange happends if not then it might have been another file causing this!

I will try that soon. but it cant b any other file, Either this or a VPN. VPN is highly unlikely, but I have posted both the files to be analyzed by someone who can.

---

o shit
If this is true, xvunerable has a pretty bigass botnet, and you can only imagine how many bots he would have if he coded in some kind of bot-stealer.

I have it downloaded in a ratting VM, so I wouldn't really care as I don't have anything valuable there.

I have no idea why this is happening. But since it has happened with many guys now, I would suggest to take precautions, a VM is totally fine though! unless he knows how to bypass VM!?

[supreme00.]

The link you included is an analysis that tells us that the executeable has a backdoor.
It drops the payload to the appdata folder and adds itself to startup.
It even has a botkiller.

https://i.imgur.com/pdRcJWW.png
https://i.imgur.com/8QPwcII.png
edit:
just seen
C:\DOCUME~1\User\LOCALS~1\Temp\njRAT v0.7d.INI
C:/DOCUME~1
C:/DOCUME~1/User
C:/DOCUME~1/User/LOCALS~1
C:/DOCUME~1/User/LOCALS~1/Temp
C:\WINDOWS\assembly\pubpol1.dat
but i recently got my computer scanned by a whitehat helper and he said it's clean
also mbam is working fine , checked my startups and looks like theres nothing

[Dafuq]

https://i.imgur.com/pdRcJWW.png
https://i.imgur.com/8QPwcII.png

Which site is this now? lmk!

[NullRootix]

Which site is this now? lmk!

http://malwr.com 🤝

[Dafuq]

https://i.imgur.com/pdRcJWW.png
https://i.imgur.com/8QPwcII.png
edit:
just seen
C:\DOCUME~1\User\LOCALS~1\Temp\njRAT v0.7d.INI
C:/DOCUME~1
C:/DOCUME~1/User
C:/DOCUME~1/User/LOCALS~1
C:/DOCUME~1/User/LOCALS~1/Temp
C:\WINDOWS\assembly\pubpol1.dat
but i recently got my computer scanned by a whitehat helper and he said it's clean
also mbam is working fine , checked my startups and looks like theres nothing

But u see that files are being dropped right?

[supreme00.]

But u see that files are being dropped right?

they are .ini files and .dat i doubt it's a rat + no network activity check yourself
i had 1400$ btcs in my wallet for months now nothing happened

[ubbelol]

But u see that files are being dropped right?

Dropping an .INI file is hardly an indication of malicious activity... Why don't you all calm down for a second and at least wait for an official response from xVulnerable or whoever made the RAT before throwing accusations left and right? It may be that you had malware installed earlier and this shit starting to happen along with the njRat download is a mere coincidence.

If I get some time over I'll analyze the file to see if there's something fishy with it.

[Dafuq]

they are .ini files and .dat i doubt it's a rat + no network activity check yourself
i had 1400$ btcs in my wallet for months now nothing happened

I seriously have no idea how these things work tbh. I wish I could analyze it myself. But I am totally dependent on third parties for it. and Many users are reporting it as malware now, not just me.

Many guys are saying they saw their webcam turn on/off after using njrat. Some are reporting problems with MBAM just like me.

[supreme00.]

I seriously have no idea how these things work tbh. I wish I could analyze it myself. But I am totally dependent on third parties for it. and Many users are reporting it as malware now, not just me.

Many guys are saying they saw their webcam turn on/off after using njrat. Some are reporting problems with MBAM just like me.

you and them may have download a rat somewhere else my mbam is working fine and my webcam never opened
just gave a look at your posts and i see you have downloaded jwatch and amother thing

[Dafuq]

Dropping an .INI file is hardly an indication of malicious activity... Why don't you all calm down for a second and at least wait for an official response from xVulnerable or whoever made the RAT before throwing accusations left and right? It may be that you had malware installed earlier and this shit starting to happen along with the njRat download is a mere coincidence.

If I get some time over I'll analyze the file to see if there's something fishy with it.

I am totally calm bro, I am not fighting with anyone, this post is just to Alert the HF members for now, coz I and some others are facing this problem. Not to defame anyone, or pick a useless fight.

[Wieno]

What if his site got hacked and somebody putted his backdoored njrat as download.