njRat malware
njRAT (Bladabindi) is a long-lived .NET remote access trojan. It provides remote shell, keylogging, webcam and file access, and usually spreads through USB propagation and phishing attachments.
Malva.RE has analysed 617 public samples tagged njRat, statically and without execution. The latest public sample was seen on 2026-10-25.
File types
- PE Executable40
Recurring C2 endpoints
32[.]tcp[.]cpolar[.]top38[.]tcp[.]cpolar[.]cn26[.]tcp[.]cpolar[.]cn2155[.]117[.]183[.]18122[.]56[.]3[.]17711[.]tcp[.]cpolar[.]cn1xuiandreya-53112[.]portmap[.]host133[.]tcp[.]cpolar[.]top16[.]tcp[.]vip[.]cpolar[.]cn1joaoszr3[.]ddns[.]net1
Defanged. Extracted statically from the configurations of public samples.
Latest public njRat samples
Analyse your own njRat sample
Malva.RE unpacks, decompiles and extracts the configuration of suspicious files statically — the file is never executed. Free-plan reports are public.
Analyse a file for free