njRAT runs MassLogger

This blog post analyzes njRAT C2 traffic extracted from a public PCAP, demonstrating that the RAT captured full-resolution screenshots, transferred gzip-compressed DLL/EXE payloads (via the "inv" and "rn" commands), and executed a MassLogger credential-stealer (CloudServices.exe). The write-up extracts artifacts and provides IOCs including MD5 hashes, the C2 IP:port, the SMTP server and exfiltration email used by MassLogger.