NjRAT Command and Control Infrastructure and Payload Updates
New NjRAT (Bladabindi) remote access trojan payloads and C2 infrastructure were identified on 2026-11-04, enabling remote system takeover.
Triage facts
Revision 1- Applicability
- Windows
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 5, 13:39 UTC
- Detection
- 5 IOCs
- Source quality
- B2Likely
ThreatFox reported seven new indicators of compromise related to NjRAT, a Remote Access Trojan (RAT). These indicators include malicious payloads and active command-and-control (C2) infrastructure identified on November 4, 2026. NjRAT, also known as Bladabindi, provides attackers with full remote system control.
Impact
Successful execution of the identified payloads results in unauthorized remote access, file system manipulation, and potential data exfiltration from compromised Windows hosts.
Recommendation
- Block the C2 IP address 104.248.130.195 on perimeter firewalls and web proxies.
- Scan endpoint file systems for the identified MD5 and SHA-256 payload hashes.
- Implement EDR blocklisting for the identified hash values to prevent execution.
Immediate actions
Block C2 IP 104.248.130.195 at perimeter
Add payload hashes to EDR blocklist
Threat Hunt
Identify outbound network traffic to 104.248.130.195 on port 7488
Data: Firewall logs, Netflow data
Indicators of compromise
2
hash_md5
2
hash_sha256
1
ip
| Type | Value |
|---|---|
| hash_md5 | 43ba5a3f20774f2ac402d8b310825f84 |
| hash_md5 | 87e0a229df9796c373e0a48031df949b |
| hash_sha256 | df565eec185189cd6281e541953975959b81524626f38272a85b6eef71c4ec16 |
| hash_sha256 | 764f0fae11de72f3c80fd07118ef290a2e432aa3d90e57443610a83317d738fe |
| ip | 104.248.130.195 |