# NjRAT variant - tXRAT v.2.3R

**URL:** <https://community.emergingthreats.net/t/njrat-variant-txrat-v-2-3r/1746>\
**Category:** Rule Signatures\
**Tags:** suricata, etopen\
**Created:** [June 21, 2024, 8:10am UTC](https://community.emergingthreats.net/t/njrat-variant-txrat-v-2-3r/1746 "2024-06-21T08:10:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\
**Post date:** [June 21, 2024, 8:10am UTC](https://community.emergingthreats.net/t/njrat-variant-txrat-v-2-3r/1746/1 "2024-06-21T08:10:24Z")

</div>

Hi, recently I discovered a modification of the famous rat NjRat, we could not detect it with the existing rules, so I propose several new ones (version obtained from traffic)

NjRat Traffic example

> 155.ll|‘|’|VEVTVF9DNEJBMzY0Nw==|‘|’|USER-PC|‘|’|admin|‘|’|24-06-20|‘|’||‘|’|Win 7 Professional SP1 x86|‘|’|No|‘|’|0.7d|‘|’|…|‘|’|UHJvZ3JhbSBNYW5hZ2VyAA==|‘|’|

tXRAT - Traffic example ( | - redacted separator replacement)

> 644.tXInfoClient|‘|’|Wy1BTk9OWU1PVVMtXQ==|‘|’|REVTS1RPUC1KR0xMSkxE|‘|’|YWRtaW4=|‘|’|24-06-19|‘|’||‘|’|V2luZG93cyAxMCBQcm8geDY0|‘|’|0J3QtdGC0YM=|‘|’|Windows Defender|‘|’|2.3R|‘|’|–|‘|’|–|‘|’|216.24.216.80|‘|’|DE|‘|’|R2VybWFueQ==|‘|’|18F7786F96EE|‘|’|XDFtzjhycufr737463|‘|’|

> **[Analysis 9488790d24ae2f1dc4d04965b8d68b910e9a2179c1be8933eb8518154e11c8b0.exe...](https://app.any.run/tasks/6df9120e-243f-44a0-a22d-9f8868db4eb9/)**
>
> Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

```auto
alert tcp any any -> any any (msg: "ET MALWARE [ANY.RUN] NjRat (tXRAT v.2.3R) Client Sends State Active Window";flow: established, to_server; 
content: "tXActiveWindow|7c|"; depth: 20;
pcre:"/^\d{2,3}\x00/";
classtype:command-and-control;  
reference:md5,917d3bcc7cbe4668fa22b8bc2f0a4092;  
reference:url,community.emergingthreats.net/t/njrat-variant-txrat-v-2-3r; 
metadata: attack_target Client_Endpoint, deployment Perimeter, former_category MALWARE, signature_severity Major, id 5456483, malware_family njrat, tag RAT, created_at 2024_06_20; sid: 1; rev: 1;)

alert tcp any any -> any any (msg: "ET MALWARE [ANY.RUN] NjRat (tXRAT v.2.3R) Server Sends Plugin to Client";flow: established, to_client; 
content: "XSendPlugin|7c|"; offset: 3; depth: 20;
pcre:"/^\d{2,5}\x00/";
classtype:command-and-control; 
reference:md5,917d3bcc7cbe4668fa22b8bc2f0a4092;  
reference:url,community.emergingthreats.net/t/njrat-variant-txrat-v-2-3r; 
metadata: attack_target Client_Endpoint, deployment Perimeter, former_category MALWARE, signature_severity Major, malware_family njrat, tag RAT, created_at 2024_06_20; sid: 2; rev: 1;)

alert tcp any any -> any any (msg: "ET MALWARE [ANY.RUN] NjRat (tXRAT v.2.3R) Client Sends Check-in Packet";flow: established, to_server; 
content: "tXInfoClient|7c|"; offset: 3; depth: 20;
pcre:"/^\d{2,4}\x00/";byte_jump:0,0,string,dec;
isdataat: !2, relative;
classtype:command-and-control;  
reference:md5,917d3bcc7cbe4668fa22b8bc2f0a4092;  
reference:url,community.emergingthreats.net/t/njrat-variant-txrat-v-2-3r; 
metadata: attack_target Client_Endpoint, deployment Perimeter, former_category MALWARE, signature_severity Major, malware_family njrat, tag RAT, created_at 2024_06_20; sid: 3; rev: 1;)

```

Best regards, Jane.

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [June 21, 2024, 4:44pm UTC](https://community.emergingthreats.net/t/njrat-variant-txrat-v-2-3r/1746/2 "2024-06-21T16:44:11Z")

</div>

Hey @Jane0sint, I’ll get these in today’s release!

Isaac