# KGB RAT: NjRAT-based Windows Trojan sold as MaaS with FUD crypter

> KGB RAT is a Windows remote access trojan derived from NjRAT (Bladabindi) and marketed on underground forums as a fully undetectable (FUD) Malware-as-a-Service with a free tier and paid subscriptions. It offers Hidden VNC, keylogging, browser credential theft, ransomware and a crypto-clipboard hijacker, and Group-IB observed multiple operators sharing the same builder.

- **Published:** 2026-10-14T09:22:44Z
- **Last reviewed:** 2026-10-14T09:22:44Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3487
- **ID:** TL-2026-3487
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 36 (full data via the Threadlinqs MCP server — Purple tier)

## Description

KGB RAT is a VB.NET Windows RAT (x86 PE) built on the NjRAT 0.7D Lime Edition/Bladabindi codebase and promoted as 'administration software' under a subscription MaaS model. Group-IB reports underground-forum promotion from late 2025, with infrastructure evidence for an early version (v0.1) dating to late January 2022. A free tier provides basic remote desktop, file management, camera/microphone access, keylogging, password recovery, persistence and anti-detection; paid plans are priced from $150/month to $800/year, with a $500 'Network Spreading' add-on for automated LAN lateral movement. A daily-updated crypter and a Unique Stub Generator (USG) produce distinct stubs to keep samples undetectable by signature AV. The builder emits EXE, BAT, REG and HTA payloads and a binder that attaches the stub to legitimate executables. Group-IB analyzed unobfuscated, obfuscated and encrypted-dropper variants.

Capabilities include Hidden VNC (HVNC), live webcam and microphone capture, file management (upload, download, delete, modify), keystroke logging (polling and hooks), screen capture (CopyFromScreen), browser, Windows Credential Manager and application password recovery, ransomware, USB propagation, LAN spreading, a BotKiller class that removes rival malware (observed in one sample), and a CryptoClipper module that swaps clipboard wallet addresses (BTC, ETH, TRC-20) with operator-controlled ones, storing values under HKCU\Software\Clipper. A 'Fun Settings' set of harassment features adds screamer audio playback (%TEMP%\scream.wav), jump scares, fake error dialogs and forced blue screens via the ProcessBreakOnTermination (Critical Process, flag 29) setting.

Execution and evasion: the stub uses runtime deobfuscation and reflective code loading, process hollowing with suspended creation, a 600-second delayed-execution routine, a 4-second C2 polling loop (4,412 iterations, about 4.9 hours, observed), mouse-click monitoring via GetAsyncKeyState to detect sandboxes, motherboard-string checks (VGNZPL985D, Test, Sandbox, Temp, Debug, Default, Trial, Virtual Machine/VM, Hyper, D1120, 700-210xt) and VM-service checks (VGAuthService, VBoxService), and it terminates analysis tools (procexp, SbieCtrl, SpyTheSpy, wireshark, apateDNS, IPBlocker, TiGeR-Firewall, smsniff, exeinfoPE, NetSnifferCs, processhacker, dnSpy, CodeReflect, Reflector, ILSpy). UAC is bypassed through HKCU\Software\Classes\ms-settings\shell\open\command (Default and DelegateExecute) with ComputerDefaults.exe, and also mscfile. The sample copies itself to %TEMP%\svchost.exe (two samples use %AllUsersProfile%), spawns cmd.exe, powershell.exe, reg.exe and schtasks.exe, and creates a scheduled task named 'ChromeUpdate' (ONLOGON, HIGHEST run level; name configurable via OK.SCHEDNAME). Persistence also uses HKCU\...\Policies\Explorer\Run (value 'Loader'), Startup-folder files and .url shortcuts, and default file association hijacking; WMI queries support discovery and execution. Hardcoded configuration values across samples include injection target svchost.exe, bypass process MoUsoCoreWorker.exe, command delimiter '|Ghost|', Base64 victim separators (Victim, King, KING), the guard file %TEMP%\obito.txt and the developer string 'WhyYouReverseMe..ImInnocent..LoveYouu..'. It sets HKCU\Environment\SEE_MASK_NOZONECHECKS=1 (an NjRAT trait) and ShowSuperHidden=0. The initial beacon carries hostname, username, date, OS version, admin status and installed AV products.

Command and control: samples beacon to 104.248.130.195 (TCP 7489, 7490, 7492; six samples, a single operator) and 2.59.134.215 (TCP 443, one sample, blending with HTTPS); kgbrat.org is the malware website. Some operators use the Telegram Bot API (api.telegram.org/bot*/sendMessage) for notification or exfiltration (two distinct bot tokens observed; one shared across two samples with different chat IDs) and victim geolocation via ip-api.com/json/. Shared infrastructure suggests a primary actor with a reseller network. Only one sample enabled the CryptoClipper for direct financial gain. Group-IB states that developers are identifiable via nicknames and social media profiles; no nation-state attribution is stated. Severity is analyst-assigned (not stated in the source), and no CVEs or CVSS apply.

## MITRE ATT&CK

- T1047 Windows Management Instrumentation
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1204.002 User Execution: Malicious File
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1546.001 Event Triggered Execution: Change Default File Association
- T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
- T1055.012 Process Injection: Process Hollowing
- T1027 Obfuscated Files or Information
- T1027.002 Obfuscated Files or Information: Software Packing
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1112 Modify Registry
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1564.003 Hide Artifacts: Hidden Window
- T1070.004 Indicator Removal: File Deletion
- T1685 Disable or Modify Tools
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1497.002 Virtualization/Sandbox Evasion: User Activity Based Checks
- T1497.003 Virtualization/Sandbox Evasion: Time Based Checks
- T1134 Access Token Manipulation
- T1056.001 Input Capture: Keylogging
- T1555.004 Credentials from Password Stores: Windows Credential Manager
- T1082 System Information Discovery
- T1057 Process Discovery

## Sources

- [KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize](https://www.group-ib.com/blog/kgb-rat-windows-fud-trojan/)
- [MITRE ATT&CK: njRAT (S0385)](https://attack.mitre.org/software/S0385/)
- [NjRAT - Wikipedia](https://en.wikipedia.org/wiki/NjRAT)
- [Splunk: More Than Just a RAT - Unveiling NjRAT's MBR Wiping Capabilities](https://splunk.com/en_us/blog/security/more-than-just-a-rat-unveiling-njrat-s-mbr-wiping-capabilities.html)
- [Cyble: Trojanized Application Preying on TeamViewer Users (NjRAT)](https://cyble.com/blog/trojanized-application-preying-on-teamviewer-users/)
- [Rewterz Threat Alert: NjRAT Active IOCs](https://rewterz.com/rewterz-news/rewterz-threat-alert-njrat-active-iocs-54)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3487