{"id":37146,"date":"2014-08-05T12:34:33","date_gmt":"2014-08-05T19:34:33","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=37146"},"modified":"2025-06-06T02:11:22","modified_gmt":"2025-06-06T09:11:22","slug":"trail-njrat","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/","title":{"rendered":"Trailing the Trojan njRAT"},"content":{"rendered":"<p>One Trojan that just won\u2019t go away is the remote access tool njRAT. Microsoft <a href=\"https:\/\/krebsonsecurity.com\/tag\/njrat\/\">recently took down <\/a>a leading domain associated with the malware, but that action did not come off as smoothly as the company hoped. We closely track this remote access tool (RAT) and see a rise in its popularity every year.<\/p>\n<p>The malware is very popular in the Middle East with the Syrian Electronic Army and other hacktivists. There are plenty of tutorials and videos online that explain its use, thus making it the de facto choice for cyber espionage.<\/p>\n<p>This RAT is coded using the Microsoft .Net framework and can remotely access a victim&#8217;s machine, operate the webcam, log keystrokes, steal credentials stored in browsers, upload and download files, and update itself. The malware has a GUI-based builder and controller tool that allows its users to create malicious binaries and remotely control all infected machines.<\/p>\n<h2><strong>Tracking the control servers<\/strong><\/h2>\n<p>A major aspect of this RAT is its popularity with dynamic domain name system (DNS) services such as no-ip.com. A dynamic DNS service is a method of automatically updating a name server in the DNS, often in real time, with the active DNS configuration of its configured hostnames, addresses, or other information.<\/p>\n<p>This feature allows attackers without a dedicated static IP, such as DSL or broadband connection, to use a DNS-based hostname. This helps the malicious actors to use any IP or Internet connection and still keep the client connections alive.<\/p>\n<p>Based on the activity we observed in our monitoring systems, here is a map of the global coverage of njRAT\u2019s control servers during the last six months:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-37148 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/njRAT_goedist.png\" alt=\"njRAT_goedist\" width=\"721\" height=\"455\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/njRAT_goedist.png 721w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/njRAT_goedist-300x189.png 300w\" sizes=\"auto, (max-width: 721px) 100vw, 721px\" \/><\/p>\n<p>All the dots signify distinct IP addresses used by njRAT as a control server. The green dots signify active campaigns, which mean the attacker was controlling machines as we took this snapshot. Here is a close-up of its popularity in the Middle East:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/njRAT_goedist2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-37149 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/njRAT_goedist2.png\" alt=\"njRAT_goedist2\" width=\"721\" height=\"456\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/njRAT_goedist2.png 721w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/njRAT_goedist2-300x189.png 300w\" sizes=\"auto, (max-width: 721px) 100vw, 721px\" \/><\/a><\/p>\n<p>Morocco, Algeria, and Iraq have the highest usage, with Algeria hosting the largest number of control server IPs (more than 4,000). The dynamic DNS service provider no-ip is owned by Vitalwerks, which offers various domain name options to its customers. During this period, we saw more than 80,000 unique domains used for njRAT that belonged to Vitalwerks. Here is the distribution: <a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/njRAT_domaindist.png\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-37147 size-full aligncenter\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/njRAT_domaindist.png\" alt=\"njRAT_domaindist\" width=\"427\" height=\"333\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/njRAT_domaindist.png 427w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/njRAT_domaindist-300x233.png 300w\" sizes=\"auto, (max-width: 427px) 100vw, 427px\" \/><\/a><\/p>\n<address style=\"text-align: center;\"><em>Domain distribution of njRAT control servers.<\/em><\/address>\n<p>Clearly, most njRAT users prefer using the domain no-ip.biz, which leads the pack with more than 47,000 distinct entries in our database.<\/p>\n<h2><strong>Obfuscation and antivirus evasion<\/strong><\/h2>\n<p>One of the reasons njRAT remains so popular is the Trojan\u2019s ability to stay under the radar and prevent antivirus detections. There are plenty of obfuscation tools available for .Net that easily allow users to obfuscate the .Net binaries.<\/p>\n<p>Similar to a packer, a .Net obfuscator tool renames the meta-information in the assembly code such that it is not possible for anyone to statically figure out the functions, yet they remain useful to execute the intended operations. The obfuscator was designed to protect against the reverse-engineering of .Net executables, but here it is put to use for nefarious purposes.<\/p>\n<p>Plenty of tutorials on YouTube explain how to make an njRAT binary undetectable by antivirus solutions, and hence the success rate of infection with njRAT is pretty high. However, the network signature remains same. This is what we use to track the threat.<\/p>\n<p>In the past year, we have collected more than 88,000 unique binaries. Using our advanced automation, we monitor this threat closely.<br \/>\n<a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/njRAT_incoming.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-37154 aligncenter\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/njRAT_incoming.png\" alt=\"njRAT_incoming\" width=\"481\" height=\"294\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/njRAT_incoming.png 481w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/njRAT_incoming-300x183.png 300w\" sizes=\"auto, (max-width: 481px) 100vw, 481px\" \/><\/a><\/p>\n<p>For a RAT, the preceding numbers are pretty high. They demonstrate how easy it is to build and deploy this malware. But what surprises us most is the count of samples received each month that have no antivirus detection:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/njRAT_noav.png\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-37151 size-full aligncenter\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/njRAT_noav.png\" alt=\"njRAT_noav\" width=\"487\" height=\"296\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/njRAT_noav.png 487w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/njRAT_noav-300x182.png 300w\" sizes=\"auto, (max-width: 487px) 100vw, 487px\" \/><\/a><\/p>\n<p>The preceding chart of \u00a0samples are not detected by any antivirus vendor at the time of submission. We refer to these as zero-day samples. But from their network communication we can confirm that they all belong to the njRAT family. We have used the malware\u2019s network signature to track this threat for more than a year.<\/p>\n<p>Due to the plethora of tutorials and information, there are some popular obfuscators for njRAT. However, we also saw some of the binaries using custom obfuscation algorithms. Based on our analysis, we found that \u201cRedGate SmartAssembly\u201d was one of most popular obfuscators used with njRAT, followed by \u201cYano\u201d and others:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/njRAT_packerdist.png\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-37152 size-full aligncenter\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/njRAT_packerdist.png\" alt=\"njRAT_packerdist\" width=\"581\" height=\"317\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/njRAT_packerdist.png 581w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/njRAT_packerdist-300x163.png 300w\" sizes=\"auto, (max-width: 581px) 100vw, 581px\" \/><\/a><\/p>\n<p>Desktop antivirus solutions have limitations, and .Net obfuscation takes advantage of that. Every month we get samples of this malware that continue to evade antivirus software. The njRAT tool is still under development on various forums and its author continues to create new versions.<\/p>\n<p>All McAfee Network Security Product (NSP) customers are already protected from this threat.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>One Trojan that just won\u2019t go away is the remote access tool njRAT. Microsoft recently took down a leading domain&#8230;<\/p>\n","protected":false},"author":674,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[3944,49,180,18],"coauthors":[3973],"class_list":["post-37146","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-antivirus","tag-botnet","tag-malware","tag-network-security"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Trailing the Trojan njRAT | McAfee Blog<\/title>\n<meta name=\"description\" content=\"One Trojan that just won\u2019t go away is the remote access tool njRAT. Microsoft recently took down a leading domain associated with the malware, but that\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Trailing the Trojan njRAT | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"One Trojan that just won\u2019t go away is the remote access tool njRAT. Microsoft recently took down a leading domain associated with the malware, but that\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2014-08-05T19:34:33+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-06T09:11:22+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/njRAT_goedist.png\" \/>\n\t<meta property=\"og:image:width\" content=\"721\" \/>\n\t<meta property=\"og:image:height\" content=\"455\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"McAfee\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/\"},\"author\":{\"name\":\"McAfee\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\"},\"headline\":\"Trailing the Trojan njRAT\",\"datePublished\":\"2014-08-05T19:34:33+00:00\",\"dateModified\":\"2025-06-06T09:11:22+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/\"},\"wordCount\":779,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/njRAT_goedist.png\",\"keywords\":[\"antivirus\",\"botnet\",\"malware\",\"network security\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/\",\"name\":\"Trailing the Trojan njRAT | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/njRAT_goedist.png\",\"datePublished\":\"2014-08-05T19:34:33+00:00\",\"dateModified\":\"2025-06-06T09:11:22+00:00\",\"description\":\"One Trojan that just won\u2019t go away is the remote access tool njRAT. Microsoft recently took down a leading domain associated with the malware, but that\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/njRAT_goedist.png\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/njRAT_goedist.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Trailing the Trojan njRAT\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\",\"name\":\"McAfee\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"caption\":\"McAfee\"},\"description\":\"We're here to make life online safe and enjoyable for everyone.\",\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/x.com\/McAfee\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Trailing the Trojan njRAT | McAfee Blog","description":"One Trojan that just won\u2019t go away is the remote access tool njRAT. Microsoft recently took down a leading domain associated with the malware, but that","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Trailing the Trojan njRAT | McAfee Blog","og_description":"One Trojan that just won\u2019t go away is the remote access tool njRAT. Microsoft recently took down a leading domain associated with the malware, but that","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2014-08-05T19:34:33+00:00","article_modified_time":"2025-06-06T09:11:22+00:00","og_image":[{"width":721,"height":455,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/njRAT_goedist.png","type":"image\/png"}],"author":"McAfee","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/"},"author":{"name":"McAfee","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa"},"headline":"Trailing the Trojan njRAT","datePublished":"2014-08-05T19:34:33+00:00","dateModified":"2025-06-06T09:11:22+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/"},"wordCount":779,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/njRAT_goedist.png","keywords":["antivirus","botnet","malware","network security"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/","name":"Trailing the Trojan njRAT | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/njRAT_goedist.png","datePublished":"2014-08-05T19:34:33+00:00","dateModified":"2025-06-06T09:11:22+00:00","description":"One Trojan that just won\u2019t go away is the remote access tool njRAT. Microsoft recently took down a leading domain associated with the malware, but that","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/njRAT_goedist.png","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/njRAT_goedist.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trail-njrat\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Trailing the Trojan njRAT"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa","name":"McAfee","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","caption":"McAfee"},"description":"We're here to make life online safe and enjoyable for everyone.","sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/x.com\/McAfee"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/37146","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/674"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=37146"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/37146\/revisions"}],"predecessor-version":[{"id":215195,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/37146\/revisions\/215195"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=37146"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=37146"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=37146"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=37146"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}