S0385 - njRAT

Name: S0385 - njRAT
Creator: Maltiverse
Published: 2023-06-13

njRAT is a remote access tool (RAT) that was first observed in 2012. It has been used by threat actors in the Middle East

Author: agomez
Created: 2023-06-13 23:59:54
Last updated: 2026-02-07 19:18:26
Downloads: 393118
IPv4 indicators: 220
Hostname indicators: 908
URL indicators: 27
Sample indicators: 904

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

discord-proxy.duckdns.org Hostname

modified 2026-10-17 11:26:38
NjRAT (ThreatFox Abuse.ch)

0.tcp.ngrok.io Hostname

modified 2026-10-17 11:25:40
Malware Download (URLhaus Abuse.ch) · Nanocore RAT (ThreatFox Abuse.ch) · RedLine Stealer (ThreatFox Abuse.ch) · MSIL:Bladabindi (Hybrid-Analysis) · Dropped:Generic.Malware.SLlg (Hybrid-Analysis)

219.153.103.109 IPv4

modified 2026-10-17 11:19:11
SSH Attacker (Blocklist.net.ua) · Suspicious Host (AbuseIPDB) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · Mail Spammer (AbuseIPDB)

217.146.80.107 IPv4

modified 2026-10-17 11:19:10
Suspicious Host (AbuseIPDB) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · VPN (IPWhois.io) · IMAP Attacker (AbuseIPDB)

217.146.80.108 IPv4

modified 2026-10-17 11:19:10
NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · Malicious Host (CIArmy) · Empty reason (Blocklist.net.ua) · Malicious Host (HoneyDB)

217.146.80.103 IPv4

modified 2026-10-17 11:19:10
Mail Spammer (Blocklist.de) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · DNS Compromise (AbuseIPDB) · FTP Attacker (AbuseIPDB)

217.146.80.109 IPv4

modified 2026-10-17 11:19:10
Suspicious Host (AbuseIPDB) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · Empty reason (Blocklist.net.ua) · Malicious Host (CIArmy)

217.146.80.102 IPv4

modified 2026-10-17 11:19:10
Suspicious Host (AbuseIPDB) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · IMAP Attacker (AbuseIPDB) · Phishing (AbuseIPDB)

81.109.5.62 IPv4

modified 2026-10-17 11:17:43
NjRAT (ThreatFox Abuse.ch) · AsyncRAT (ThreatFox Abuse.ch) · Quasar RAT (ThreatFox Abuse.ch) · HTTP Spammer (StopForumSpam.com)

152.32.198.210 IPv4

modified 2026-10-17 11:14:40
Mail Spammer (Abuseat.org) · FTP Attacker (Blocklist.de) · HTTP Attacker (Blocklist.de) · IMAP Attacker (Blocklist.de) · VPN (AbuseIPDB)

152.32.157.3 IPv4

modified 2026-10-17 11:14:12
Mail Spammer (Abuseat.org) · FTP Attacker (Blocklist.de) · HTTP Attacker (Blocklist.de) · Phishing (AbuseIPDB) · DNS Poisoning (AbuseIPDB)

148.66.133.188 IPv4

modified 2026-10-17 11:14:12
Mail Spammer (Abuseat.org) · Suspicious Host (AbuseIPDB) · HTTP Attacker (Blocklist.de) · Unauthorized scanning of hosts (Blocklist.net.ua) · DDoS attack (AbuseIPDB)

152.32.141.9 IPv4

modified 2026-10-17 11:14:12
Mail Spammer (Abuseat.org) · HTTP Attacker (Blocklist.de) · Phishing (AbuseIPDB) · Mail Spammer (Barracuda) · IMAP Attacker (AbuseIPDB)

51.158.202.242 IPv4

modified 2026-10-17 11:13:12
NjRAT (ThreatFox Abuse.ch) · Suspicious Host (AbuseIPDB) · HTTP Spammer (StopForumSpam.com) · Proxy (IPWhois.io) · Proxy (FireHOL)

69.5.169.105 IPv4

modified 2026-10-17 11:10:12
Proxy (IPWhois.io) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · Generic Malware (Maltiverse Threat Observatory) · Proxy (AbuseIPDB)

69.5.169.108 IPv4

modified 2026-10-17 11:10:12
Proxy (IPWhois.io) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · Phishing (AbuseIPDB) · Proxy (AbuseIPDB)

69.5.169.106 IPv4

modified 2026-10-17 11:10:12
Proxy (IPWhois.io) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · VPN (IPWhois.io) · IoT Attacker (AbuseIPDB)

69.5.169.109 IPv4

modified 2026-10-17 11:10:12
Proxy (IPWhois.io) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · DNS Compromise (AbuseIPDB) · DNS Poisoning (AbuseIPDB)

69.5.169.100 IPv4

modified 2026-10-17 11:10:11
Proxy (IPWhois.io) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · DNS Compromise (AbuseIPDB) · DNS Poisoning (AbuseIPDB)

69.5.169.102 IPv4

modified 2026-10-17 11:10:11
Suspicious Host (AbuseIPDB) · Proxy (IPWhois.io) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · Proxy (AbuseIPDB)

69.5.169.101 IPv4

modified 2026-10-17 11:10:11
Proxy (IPWhois.io) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · SSH Attacker (Blocklist.de) · IMAP Attacker (Blocklist.de)

47.84.102.221 IPv4

modified 2026-10-17 11:08:11
Suspicious Host (AbuseIPDB) · NjRAT (ThreatFox Abuse.ch) · Malicious Host (AbuseIPDB) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · Malicious Host (HoneyDB)

47.77.225.110 IPv4

modified 2026-10-17 11:08:10
Suspicious Host (AbuseIPDB) · NjRAT (ThreatFox Abuse.ch) · Phishing (AbuseIPDB) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · Malicious Host (HoneyDB)

47.84.100.118 IPv4

modified 2026-10-17 11:08:10
Suspicious Host (AbuseIPDB) · NjRAT (ThreatFox Abuse.ch) · Malicious Host (HoneyDB) · DNS Compromise (AbuseIPDB) · FTP Attacker (AbuseIPDB)

47.77.198.243 IPv4

modified 2026-10-17 11:08:10
Suspicious Host (AbuseIPDB) · NjRAT (ThreatFox Abuse.ch) · Malicious Host (AbuseIPDB) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · Malicious Host (HoneyDB)

47.84.137.161 IPv4

modified 2026-10-17 11:08:10
Suspicious Host (AbuseIPDB) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · Mail Spammer (AbuseIPDB) · SSH Attacker (AbuseIPDB)

47.77.225.186 IPv4

47.84.100.111 IPv4

modified 2026-10-17 11:08:10
Suspicious Host (AbuseIPDB) · NjRAT (ThreatFox Abuse.ch) · DDoS Attacker (AbuseIPDB) · Mail Spammer (AbuseIPDB) · SQL Injection (AbuseIPDB)

47.254.216.76 IPv4

modified 2026-10-17 11:07:41
Suspicious Host (AbuseIPDB) · NjRAT (ThreatFox Abuse.ch) · Malicious Host (AbuseIPDB) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · Malicious Host (HoneyDB)

47.251.116.252 IPv4

modified 2026-10-17 11:07:11
Suspicious Host (AbuseIPDB) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · Mail Spammer (AbuseIPDB) · DDoS Attacker (AbuseIPDB)

47.251.105.228 IPv4

modified 2026-10-17 11:07:11
Suspicious Host (AbuseIPDB) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · SQL Injection (AbuseIPDB) · SSH Attacker (AbuseIPDB)

47.251.30.247 IPv4

modified 2026-10-17 11:07:10
SSH Attacker (Blocklist.de) · Suspicious Host (AbuseIPDB) · NjRAT (ThreatFox Abuse.ch) · FTP Attacker (AbuseIPDB) · Known Attacker (AbuseIPDB)

47.250.172.169 IPv4

modified 2026-10-17 11:07:10
Suspicious Host (AbuseIPDB) · NjRAT (ThreatFox Abuse.ch) · Malicious Host (AbuseIPDB) · Malicious Host (HoneyDB) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats)

8.211.45.194 IPv4

modified 2026-10-17 11:02:40
HTTP Attacker (Blocklist.de) · DNS Compromise (AbuseIPDB) · DNS Poisoning (AbuseIPDB) · DDoS attack (AbuseIPDB) · Known Attacker (AbuseIPDB)

8.211.29.198 IPv4

modified 2026-10-17 11:02:40
Suspicious Host (AbuseIPDB) · NjRAT (ThreatFox Abuse.ch) · Malicious Host (AbuseIPDB) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · Malicious Host (HoneyDB)

8.216.17.196 IPv4

modified 2026-10-17 11:02:40
Suspicious Host (AbuseIPDB) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · IoT Attacker (AbuseIPDB) · FTP Attacker (AbuseIPDB)

8.221.136.6 IPv4

modified 2026-10-17 11:02:40
HTTP Attacker (Blocklist.de) · FTP Attacker (AbuseIPDB) · DDoS attack (AbuseIPDB) · Suspicious Host (AbuseIPDB) · SSH Attacker (Blocklist.de SSH)

71.229.43.123 IPv4

modified 2026-10-17 11:02:31
DDoS attack (AbuseIPDB) · Suspicious Host (AbuseIPDB) · HTTP Attacker (Blocklist.de) · Bruteforce login attacker (Blocklist.de) · Phishing (AbuseIPDB)

8.211.136.6 IPv4

modified 2026-10-17 11:02:09
Suspicious Host (AbuseIPDB) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · Malicious Host (AbuseIPDB) · Malicious Host (HoneyDB)

182.95.106.102 IPv4

modified 2026-10-17 11:01:09
Suspicious Host (AbuseIPDB) · Malicious Host (HoneyDB) · SIP Attacker (AbuseIPDB) · HTTP Scrapper (AbuseIPDB) · DDoS Attacker (AbuseIPDB)

176.109.10.49 IPv4

modified 2026-10-17 11:01:00
Suspicious Host (AbuseIPDB) · NjRAT (ThreatFox Abuse.ch) · HTTP Attacker (Blocklist.de) · Bruteforce login attacker (Blocklist.de) · SIP Attacker (AbuseIPDB)

125.130.249.158 IPv4

modified 2026-10-17 11:00:34
DNS Compromise (AbuseIPDB) · SSH Attacker (Blocklist.de) · DDoS attack (AbuseIPDB) · FTP Attacker (AbuseIPDB) · Bruteforce (Blocklist.net.ua)

122.187.249.88 IPv4

modified 2026-10-17 11:00:33
FTP Attacker (AbuseIPDB) · DNS Compromise (AbuseIPDB) · DDoS attack (AbuseIPDB) · IMAP Attacker (Blocklist.de IMAP) · Mail Spammer (Blocklist.de Mail)

116.178.155.143 IPv4

modified 2026-10-17 11:00:24
Suspicious Host (AbuseIPDB) · NjRAT (ThreatFox Abuse.ch) · HTTP Attacker (Blocklist.de) · Bruteforce login attacker (Blocklist.de) · Malicious Host (HoneyDB)

http://www.flightsimtools.com/texture_doctor/TextureDoctor_1.00.exe URL

modified 2026-10-17 10:33:22
Njrat (Maltiverse Threat Observatory)

commission-machines.gl.at.ply.gg Hostname

modified 2026-10-17 10:29:59
NjRAT (ThreatFox Abuse.ch)

46.246.12.11 IPv4

modified 2026-10-17 10:25:06
HTTP Spammer (Sblam) · Anonymizer (Maltiverse Research Team) · Anonymizer (Maltiverse) · NjRAT (ThreatFox Abuse.ch) · DCRat (ThreatFox Abuse.ch)

nj.exe Sample

modified 2026-10-17 10:24:34
Njrat (Triage)

Payload.exe Sample

modified 2026-10-17 10:20:42
Njrat (Triage)

Payload.exe Sample

modified 2026-10-17 09:32:51
Njrat (Triage)

wx.exe Sample

modified 2026-10-17 09:27:08
Njrat (Triage)

cafafa6e44ae28fbbd219a8cd26d487d50c2910409c8d9854d937f137e458fdd Sample

modified 2026-10-17 09:13:35
Xworm (Triage) · njrat (MalwareBazaar Abuse.ch)

warning.ddns.net Hostname

modified 2026-10-17 09:09:24
NjRAT (ThreatFox Abuse.ch)

Program3.exe Sample

modified 2026-10-17 09:06:31
Njrat (Triage)

146.70.194.244 IPv4

modified 2026-10-17 09:00:10
HTTP Spammer (Cleantalk.org) · SSH Attacker (Blocklist.de) · Proxy (AbuseIPDB) · DDoS attack (AbuseIPDB) · HTTP bot (Blocklist.de)

146.70.194.246 IPv4

modified 2026-10-17 09:00:10
HTTP Spammer (Cleantalk.org) · FTP Attacker (AbuseIPDB) · DDoS attack (AbuseIPDB) · IMAP Attacker (Blocklist.de) · Mail Spammer (Blocklist.de)

simo1997.zapto.org Hostname

modified 2026-10-17 08:41:46
NjRAT (ThreatFox Abuse.ch) · Covid19 scam (Cyber Threat Coalition) · Malicious Hostname (Cyber Threat Coalition)

trabsonrx.duckdns.org Hostname

modified 2026-10-17 08:41:38
NjRAT (ThreatFox Abuse.ch)

rr123.zapto.org Hostname

modified 2026-10-17 08:41:32
NjRAT (ThreatFox Abuse.ch)

anis76.no-ip.biz Hostname

modified 2026-10-17 08:41:28
NjRAT (ThreatFox Abuse.ch)

ramyok.no-ip.biz Hostname

modified 2026-10-17 08:41:27
NjRAT (ThreatFox Abuse.ch)

gamezer1hack.sytes.net Hostname

modified 2026-10-17 08:41:26
Unsafe.AI_Score_99% (Hybrid-Analysis) · Trojan.Generic (Hybrid-Analysis) · NjRAT (ThreatFox Abuse.ch)

salahizwi.no-ip.biz Hostname

modified 2026-10-17 08:41:26
NjRAT (ThreatFox Abuse.ch)

evanov-evo.no-ip.biz Hostname

modified 2026-10-17 08:41:25
NjRAT (ThreatFox Abuse.ch)

kjsf6gj9.no-ip.info Hostname

modified 2026-10-17 08:41:13
NjRAT (ThreatFox Abuse.ch)

salohash1998.no-ip.biz Hostname

modified 2026-10-17 08:41:08
NjRAT (ThreatFox Abuse.ch)

refuseniks.no-ip.biz Hostname

modified 2026-10-17 08:41:05
NjRAT (ThreatFox Abuse.ch)

host1for2njrat.no-ip.biz Hostname

modified 2026-10-17 08:41:03
NjRAT (ThreatFox Abuse.ch)

source-seconds.at.ply.gg Hostname

modified 2026-10-17 08:40:59
NjRAT (ThreatFox Abuse.ch)

2.tcp.ngrok.io Hostname

modified 2026-10-17 08:40:56
Nanocore RAT (ThreatFox Abuse.ch) · RedLine Stealer (ThreatFox Abuse.ch) · Backdoor.Bladabindi (Hybrid-Analysis) · Malware.Generic (Hybrid-Analysis) · MSIL_Bladabindi.A.gen (Hybrid-Analysis)