njRAT Lime Edition

The njRAT Lime Edition is an update of the Backdoor.Ratenjay, AKA, njRAT. The original version of this backdoor Trojan includes comprehensive features for disabling your PC's security and giving a remote attacker control over it. The new version also has support for third-party ransoming attacks that may block your files or deliver extortionist messages. As a high-level threat, removing the njRAT Lime Edition always should be left to appropriate anti-malware software or experts, while remote backups can keep the Trojan from damaging any data beyond the possibility of restoring.

Middle Eastern Trojans, Now Available with an Encryption Flavoring

A threat actor is dabbling in a Ransomware-as-a-Service business that's bundling the full capabilities of a Remote Access Trojan with its file-locking features. Although it isn't detectable in the wild currently, malware experts note that the njRAT Lime Edition includes all of the past functions of the original njRAT or Backdoor.Ratenjay in accompaniment with new, extortionist ones. Besides letting cybercrooks control your computer, the njRAT Lime Edition also can block the contents of your hard drive for supporting its demands for payment.

The developer of the njRAT Lime Edition has made few changes to the core RAT program, which retains capabilities such as keylogging, screen-grabbing, botnet recruitment and a worm-like feature for copying itself to other devices. However, he also adds a separate module for delivering data-encrypting attacks and accompanying ransom messages traditionally, such as:

• A desktop wallpaper-changing function may reset your background to an extortion-themed warning or image.
• An encryption feature using an unknown cipher may convert your media to illegible formats automatically. Such attacks often block content like documents, spreadsheets, pictures, archives or movies.
• The njRAT Lime Edition also may deliver pop-ups or ransom instructions for your files in MsgBox objects, Notepad text messages and HTML windows.
• Automatic BitTorrent supports lets the njRAT Lime Edition hijack the network resources of the infected PC for downloading or uploading content, such as copies of itself.

Threat actors who purchase the njRAT Lime Edition's client can use an administrative panel for controlling some of these features or tracking specific infections and ransom transactions. Unlike most RaaS-based Trojans, the njRAT Lime Edition offers highly flexible configurations for its messages, although, by default, it asks for Bitcoin as the preferred payment method.

Washing out the Taste of Bad Limes

Many Trojans that focus on giving cybercrooks control over infected PCs try to obfuscate their presence in any number of ways, such as injecting their code into another program's memory process or hijacking root privileges. In light of this fact, malware experts are finding the njRAT Lime Edition's update a two-edged weapon, with symptoms that can help alert the users, even while they're causing additional problems. Users suspecting that the njRAT Lime Edition is infecting their PCs also should presume that the cybercrooks may be capable of controlling it remotely and take precautions like disabling their network connections temporarily.

File-encrypting Trojans often will make false claims about the strength of their data-locking techniques. Victims sometimes can use free recovery tools from various entities in the cyber-security sector for 'unlocking' any hostage content. Since malware analysts have no information on the strength or variability of the njRAT Lime Edition's encryption module, the most comprehensive protection they can recommend is making regular backups for restoration afterward. Automatic removal of the njRAT Lime Edition with a dedicated anti-malware program should be considered mandatory for your PC's safety.

One could argue that it's better to deal with an infection by a Trojan with tangible evidence instead of one that attempts total invisibility, as is the difference between the njRAT Lime Edition and Backdoor.Ratenjay. However, knowing a Trojan is on your PC may not help you save your files if you're remiss in securing them.

Technical Details