While not encrypted, Platinum uses to hide the command response. This "rolling cipher" bypasses many signature-based IDS rules that look for plaintext "NjRAT" strings. The "Platinum" Arsenal: Capabilities That Terrify Defenders The author of Platinum added five proprietary modules that elevate this RAT beyond spyware. Module 1: Hidden VNC (Reverse Proxy) Unlike standard Remote Desktop, Platinum uses a reverse proxy over port 443 (SSL tunneled). This allows the attacker to browse the victim's files and desktop through a web-based viewer, bypassing corporate firewalls that block outbound 3389. Module 2: USB Spread (Silent Worm) If the attacker checks a box, NjRAT Platinum writes autorun.inf and a copy of itself to every USB drive. When the victim takes that drive to an air-gapped machine, the infection jumps the gap. Module 3: Clipper (Cryptocurrency Swapper) This is the money maker. Platinum monitors the clipboard for Bitcoin, Ethereum, or Monero addresses. When the victim copies a wallet address, the malware replaces it with the attacker’s address.
If you found this analysis useful, share it with your SOC team. For IoCs (Indicators of Compromise) related to the latest Platinum campaign, subscribe to our threat intelligence feed below.
NjRAT Platinum is no longer just a RAT. It is the skeleton key for modern cyberattacks. Final Thoughts As defenders, we often chase the "next big thing"—Log4j, PrintNightmare, ZeroLogon. But while we look up, NjRAT Platinum Edition continues to crawl through the floorboards of unpatched Windows 7 machines and over-confident SMBs. njrat platinum edition
Then there is (also known as H-Worm or Bladabindi).
GET /index.php?act=785634127890&id=PC-NAME&user=USERNAME&os=WIN10&ver=Platinum_2.1 While not encrypted, Platinum uses to hide the
In Q3 2023, security researchers observed Platinum variants incorporating —meaning attackers use NjRAT as a first-stage dropper for ransomware payloads.
Published: October 26, 2023 | Category: Malware Analysis | Threat Level: Severe Introduction: The RAT that Refuses to Die In the shadowy bazaars of cybercrime, most malware families have a shelf life of months. Patches get released, signatures get written, and botnets crumble. Module 1: Hidden VNC (Reverse Proxy) Unlike standard
Result: The victim sends crypto to the attacker, sees a valid address in the "Paste" field, and only realizes the fraud days later. Standard NjRAT struggles with modern webcams. Platinum uses ICaptureGraphBuilder2 (DirectShow) to grab frames even when the "Webcam in use" LED is on for some older models. Module 5: Firewall Exfiltration (Windows Defender Exclusion) Upon execution, Platinum runs: powershell Add-MpPreference -ExclusionPath C:\Users\Public\