Some sources have discussed Njw0rm as a later variant of njRAT, where Njw0rm adds the ability to spread via removable devices such as USB drives.^[2] Other sources contain that functionality in their description of njRAT itself.^[1][3]

^[1]

^[1][3]

njRAT has used HTTP for C2 communications.^[3]

njRAT gathers information about opened windows during the initial infection.^[1]

njRAT has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\ and dropped a shortcut in %STARTUP%.^[1][3]

njRAT has executed PowerShell commands via auto-run registry key persistence.^[3]

njRAT can launch a command shell interface for executing commands.^[1]

njRAT has a module that steals passwords saved in victim web browsers.^[1][3][4]

njRAT uses Base64 encoding for C2 traffic.^[1]

njRAT can collect data from a local system.^[1]

njRAT has modified the Windows firewall to allow itself to communicate through the firewall.^[1][3]

njRAT has used a fast flux DNS for C2 IP resolution.^[3]

njRAT has used C2 infrastructure to receive stolen information from the infected machine including screenshots and other system information.^[3][5]

njRAT can browse file systems using a file manager module.^[1]

njRAT is capable of deleting files.^[1][3]

njRAT is capable of manipulating and deleting registry keys, including those used for persistence.^[3]

njRAT can download files to the victim’s machine.^[1][3] APT-C-36 has used modified versions of njRAT to enable the download of .NET assemblies.^[5]

njRAT is capable of logging keystrokes.^[1][3][4][5]

njRAT can create, delete, or modify a specified Registry key or value.^[1][3]

njRAT has used the ShellExecute() function within a script.^[3]

njRAT has used port 1177 for HTTP C2 communications.^[3]

njRAT has used AutoIt to compile the payload and main script into a single executable after delivery.^[3]

njRAT has included a base64 encoded executable.^[3]

njRAT will attempt to detect if the victim system has a camera during the initial infection. njRAT can also detect any removable drives connected to the system.^[1][3]

njRAT can search a list of running processes for Tr.exe.^[3]

njRAT can read specific registry values.^[3]

njRAT has a module for performing remote desktop access.^[1][5]

njRAT can identify remote hosts on connected networks.^[1]

njRAT can be configured to spread via removable drives.^[1][3]

njRAT can capture screenshots of the victim’s machines.^[3][5]

njRAT enumerates the victim operating system and computer name during the initial infection.^[1]

njRAT enumerates the current user during the initial infection.^[1]

njRAT can access the victim's webcam.^[1][4]

APT-C-36 has used a customized version of njRAT.^[5][6][7]

^[8]

^[4]

^[9]

^[10]

^[11]

^[12]

^[13][14]

^[15]