ThreatFox: NjRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets the presence of known NjRAT indicators of compromise, which are frequently used by adversaries to establish remote access and execute malicious payloads on compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected assets before the remote access trojan can be leveraged for lateral movement or data exfiltration.

IOC Summary

Malware Family: NjRAT Total IOCs: 6 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`96add574a522e59eadea6ee8355f74a43c46f742`	payload	2026-09-10	95%
md5_hash	`29d87ed8ebc9b05426800ad3c13a8fcd`	payload	2026-09-10	95%
sha256_hash	`c92f2e4f8ebfa4a61f3b17663076cb8513f26bc60fbdbe6faea232f621b6e802`	payload	2026-09-10	95%
sha256_hash	`54fced67df11a75293cb6620d57101aca7dea30fcafe9ff40df3626388328d9e`	payload	2026-09-10	95%
sha1_hash	`9ec707497613b9efae6a7af45a01a597e23b831e`	payload	2026-09-10	95%
md5_hash	`30f23cd8c071deac110bbaa70e4260cc`	payload	2026-09-10	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NjRAT
let malicious_hashes = dynamic(["96add574a522e59eadea6ee8355f74a43c46f742", "29d87ed8ebc9b05426800ad3c13a8fcd", "c92f2e4f8ebfa4a61f3b17663076cb8513f26bc60fbdbe6faea232f621b6e802", "54fced67df11a75293cb6620d57101aca7dea30fcafe9ff40df3626388328d9e", "9ec707497613b9efae6a7af45a01a597e23b831e", "30f23cd8c071deac110bbaa70e4260cc"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — NjRAT

False Positive Guidance

Scenario: A DevOps engineer deploys a custom internal monitoring agent or logging tool that uses the same hash or IP range as one of the NjRAT IOCs for local telemetry collection.
- Filter/Exclusion: Exclude alerts where the source process is a known internal binary (e.g., telemetry-agent.exe) and the parent process is the deployment script (e.g., powershell.exe or ansible-playbook).
Scenario: A scheduled maintenance job (e.g., Task Scheduler entry “NightlyBackup”) connects to a specific internal storage server IP that coincidentally matches an NjRAT C2 IP IOC due to a recent network re-addressing or shared hosting provider.
- Filter/Exclusion: Exclude alerts where the destination IP is in the internal RFC1918 range (10.x.x.x, 172.16.x.x–172.31.x.x, 192.168.x.x) and the source process is associated with backup software (e.g., Veeam.exe, CommvaultAgent.exe).
Scenario: A security team runs a YARA scan or memory dump analysis using a tool like YARA64.exe or Volatility that loads NjRAT signature files into memory, triggering hash-based IOCs.
- Filter/Exclusion: Exclude alerts where the source process is a known security tool (e.g., yara.exe, volatility3.exe, floss.exe) and the parent process is a command-line interface or security console.
Scenario: An application server running a legacy Java or .NET application establishes a connection to a public API endpoint that shares a port or IP with an NjRAT IOC, often used for license validation or update checks.