Anvilpoint CyberOps - Hacker for Hire ◆ Private Crypter - Unique Private Stubs ◆ Spoof Call and Spoof SMS set any caller ◆ ProxiesFood: Unlimited Residential Proxy ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Blackhat • Red Team • Offensive Security Remote Administration Tools › [njRat] [ALERT] I downloaded njRAT by the link on HF. HACKED. [UPDATED info]

Thread Closed 

[njRat] [ALERT] I downloaded njRAT by the link on HF. HACKED. [UPDATED info]
number7
number7 Offline
[n00b@HF:]
*
HF l33t
Posts:
48
Threads:
10
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
May 20, 2015 09:23 AM (This post was last modified: May 20, 2015 09:23 AM by number7.)
you should always have a separate pc for ratting anyway a clean pc with no real info on it just for rating in my opinion
not like u need a super fast pc for rating most people have a old pc laying around that could be reformatted and set up just for this and only give it internet connection when needed :)

just my opinion
Dafuq
Dafuq Offline
Certified Shit poster
***
HF Ub3r
Posts:
1,869
Threads:
88
Credibility:
1300
Popularity:
498
βytes:
β 38
Game XP:
237
May 20, 2015 09:24 AM (This post was last modified: May 20, 2015 09:24 AM by Dafuq.)
(May 20, 2015 09:22 AM)Wieno Wrote:  What if his site got hacked and somebody putted his backdoored njrat as download.

I never said that xVulnerables is definitely the one responsible, i just stated the events. I dont know who did it and why. :)

(May 20, 2015 09:23 AM)number7 Wrote:  you should always have a separate pc for ratting anyway a clean pc with no real info on it just for rating in my opinion
not like u need a super fast pc for rating most people have a old pc laying around that could be reformatted and set up just for this and only give it internet connection when needed :)

just my opinion

Totally correct. I will keep it in mind considering I have two laptops at my disposal.
Geo Trouvetou
Geo Trouvetou Offline
[n00b@HF:]
*
Registered
Posts:
88
Threads:
7
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
May 20, 2015 10:38 AM (This post was last modified: May 20, 2015 11:00 AM by Geo Trouvetou.)
MD5 Checksum are same from the original link given by xVuln's post and one you sent.
- 473e1a7be89c3a727176d4f9f5a64b69

njRAT install itself at startup and drop configs and *.exe files in your Temp folder at start, while running it connects to the IP: ip-176-98-110-78.static.mo-nex.cz:49261(VPN)

Spoiler (Click to View)

I found nothing more, hope than someone can make a reverse engineering and say to us if it's backdoor or not.
Dafuq
Dafuq Offline
Certified Shit poster
***
HF Ub3r
Posts:
1,869
Threads:
88
Credibility:
1300
Popularity:
498
βytes:
β 38
Game XP:
237
May 20, 2015 10:42 AM
(May 20, 2015 10:38 AM)Geo Trouvetou Wrote:  MD5 Checksum are same from the original link given by xVuln's post and one you sent.
- 473e1a7be89c3a727176d4f9f5a64b69

njRAT install itself at startup and drop configs and *.exe files in your Temp folder at start, while running it connects to the IP: ip-176-98-110-78.static.mo-nex.cz:49261(VPN)

Spoiler (Click to View)

I found nothing more, hope than someone can make a reverse engineering and say to us if it's backdoor or not.

I am waiting for the same. A mentor asked me to take up with matter with omni, but I think that we should wait for xVulnerable. Lets c what he says.
mrfong
mrfong Offline
[closed@HF:]
Posts:
566
Threads:
67
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
May 20, 2015 10:42 AM
Confirmed, this is infected, it fucked my whole system, my passwords got changed, everything i have started acting wierd, atleast i dont have a cam :D so there is no problems with that, i'm not sure if xvuln did it , but the link is backdoored atm.
Dafuq
Dafuq Offline
Certified Shit poster
***
HF Ub3r
Posts:
1,869
Threads:
88
Credibility:
1300
Popularity:
498
βytes:
β 38
Game XP:
237
May 20, 2015 10:44 AM
(May 20, 2015 10:42 AM)mrfong Wrote:  Confirmed, this is infected, it fucked my whole system, my passwords got changed, everything i have started acting wierd, atleast i dont have a cam :D so there is no problems with that, i'm not sure if xvuln did it , but the link is backdoored atm.

I understand u and a few others are sharing the same problem as me. We can only wait to see what he has to say.
Geo Trouvetou
Geo Trouvetou Offline
[n00b@HF:]
*
Registered
Posts:
88
Threads:
7
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
May 20, 2015 10:48 AM (This post was last modified: May 20, 2015 10:53 AM by Geo Trouvetou.)
Yep, but i do not think he will tell us yes or not it is infected, lol.
A lot of AV's say at result: MSIL/Bladabindi
So, when we go to the Microsoft website, they said:
- http://www.microsoft.com/security/portal...Bladabindi

Hoping that this matter be resolved quickly!

(May 20, 2015 10:45 AM)Joker™ Wrote:  Hey op you can compare md5 of mine and his njRat.

https://hackforums.net/showthread.php?tid=4829453

473E1A7BE89C3A727176D4F9F5A64B69

It's the same.
lavic2001
Guest
 
May 20, 2015 10:51 AM
Im 100% sure he did this. Just take a look:

(This post was last modified: 03-22-2015 04:12 PM by xVulnerable.
Tɦɛ Gʀiɱ
Tɦɛ Gʀiɱ Offline
ℑ??????
*****
HF Ub3r
Posts:
11,936
Threads:
645
Credibility:
5202
Popularity:
952
βytes:
β 0
Game XP:
0
May 20, 2015 10:53 AM (This post was last modified: May 20, 2015 10:54 AM by Tɦɛ Gʀiɱ.)
Ah damn, I might have downloaded it lol.
[Image: xITDbw2.gif]
Dafuq
Dafuq Offline
Certified Shit poster
***
HF Ub3r
Posts:
1,869
Threads:
88
Credibility:
1300
Popularity:
498
βytes:
β 38
Game XP:
237
May 20, 2015 11:01 AM (This post was last modified: May 20, 2015 11:02 AM by Dafuq.)
(May 20, 2015 10:53 AM)Tɦɛ Gʀiɱ Wrote:  Ah damn, I might have downloaded it lol.

I just hope someone can say for sure which one of the two files was backdoor-ed.

(May 20, 2015 10:51 AM)lavic2001 Wrote:  Im 100% sure he did this. Just take a look:

(This post was last modified: 03-22-2015 04:12 PM by xVulnerable.

i know abt the recent modification. Still, lets c..
mrfong
mrfong Offline
[closed@HF:]
Posts:
566
Threads:
67
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
May 20, 2015 11:03 AM
Guys, i took 4 njrats from 4 diffrent places 2 from hf , 1 from dev point and 1 from ratting arab group, all of them are the same size and with the same md5 hash, it might be another file that is with njrat it self..
supreme00.
Guest
 
May 20, 2015 11:05 AM
https://i.imgur.com/8pRVgeH.png
2.exe = vuln's download of 2 months ago
njrat.exe = vuln's 6 months old download
joker = joker's download
all three files have the same md5 and from the malwr's scan i made looks like there is no rat binded to it
⁠Cammy
⁠Cammy Offline
[closed@HF:]
Posts:
13,627
Threads:
283
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
May 20, 2015 11:09 AM
(May 20, 2015 11:05 AM)supreme00. Wrote:  https://i.imgur.com/8pRVgeH.png
2.exe = vuln's download of 2 months ago
njrat.exe = vuln's 6 months old download
joker = joker's download
all three files have the same md5 and from the malwr's scan i made looks like there is no rat binded to it

there is more than 1 file in the rar, could you check each and every one of them please? ty
Dafuq
Dafuq Offline
Certified Shit poster
***
HF Ub3r
Posts:
1,869
Threads:
88
Credibility:
1300
Popularity:
498
βytes:
β 38
Game XP:
237
May 20, 2015 11:10 AM (This post was last modified: May 20, 2015 11:12 AM by Dafuq.)
All the dlls with njRAT are detected as trojans. Was submitting my report to mrt when I noticed this.
mrfong
mrfong Offline
[closed@HF:]
Posts:
566
Threads:
67
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
May 20, 2015 11:11 AM
(May 20, 2015 11:09 AM)Joker™ Wrote:  Maybe it's cuz of any other app you downloaded?

But the op stated that he got only the vpn and that rat.. so it's kinda of impossible, but how come it happend with many people and today?
Next Oldest | Next Newest
Thread Closed 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by CnPxJun 23, 2025 06:44 AM 37 5,130 Jun 23, 2025 06:44 AM
Last Post: anonymousdsa
by Newton3rdLawMar 31, 2022 12:53 PM 6 449 Mar 31, 2022 12:53 PM
Last Post: 1origin23
by HOLLOWZOct 14, 2021 10:26 AM 20 3,994 Oct 14, 2021 10:26 AM
Last Post: Keurig