TF-MAL-jar.adwind
📛 Threat Title
Malware family: AdWind
Description
ThreatFox malware family `jar.adwind`. Printable name: AdWind. Aliases: AlienSpy,JSocket,Frutas,UNRECOM,JBifrost,Sockrat.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
jar.adwind
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/jar.adwind
IOC database
- Type
- domain
- Value
jar.adwind- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-jar.adwind
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/jar.adwind
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:any.run
Adwind is a remote access trojan or RAT, also called Unrecom, Sockrat, Frutas, jRat, and JSocket. Follow live malware statistics of this trojan and get new reports, samples, IOCs, etc.
-
web:bazaar.abuse.ch
A malware sample can be associated with only one malware family . The page below gives you an overview on malware samples that MalwareBazaar has identified as Adwind .
-
web:cyberpress.org
Customized Adwind RAT is being weaponized to deploy a new ransomware family dubbed JanaWare in a geographically focused campaign targeting Turkish users and small organizations via phishing-driven Java malware . Researchers observed a customized Adwind Java RAT variant whose behavior diverged from other samples during sandbox testing, ultimately dropping a Turkish-language ransom note on ...
-
web:cybersight-security.github.io
The creators of Adwind have demonstrated a high level of technical proficiency, continuously updating the malware to evade detection by antivirus solutions and incorporating new features to enhance its functionality.
-
web:github.com
On execution it will create a LaunchAgent so it will survive a system reboot.The malware is able to download and execute additional malicious files, execute remote commands and collect and send data from infected machine.In September 2018, new Adwind campaign was discovered attacking macOS, Windows and Linux OS, which was mostly targeting users ...
-
web:intel.mjolnirsecurity.com
RAT Detection & Removal Identify and remediate Adwind RAT infections including persistence mechanisms and lateral movement artifacts. Threat Intelligence Continuous monitoring for Adwind RAT campaigns and infrastructure targeting your organization.
-
web:malpedia.caad.fkie.fraunhofer.de
Part of Malware -as-service platform Used as a generic name for Java-based RAT Functionality - collect general system and user information - terminate process -log keystroke -take screenshot and access webcam - steal cache password from local or web forms - download and execute Malware - modify registry - download components - Denial of Service attacks - Acquire VPN certificates Initial ...
-
web:unit42.paloaltonetworks.com
Distributed since 2012, sale of the Adwind RAT family has resulted in tens of thousands of malware samples in the wild and millions of malware attacks. Over the last eight years, Adwind Andrés has unsuccessfully attempted to hide his identity as the author of this malware and distance himself using successive rebrands.
-
web:www.darkreading.com
The Adwind remote access Trojan conceals malicious activity in Java commands to slip past threat intelligence tools and steal user data.
-
web:www.kaspersky.com
What is Adwind ? Adwind RAT, a cross-platform, multifunctional malware program also known as AlienSpy, Frutas, Unrecom, Sockrat, JSocket and jRat, and which is distributed through a single malware -as-a-service platform.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.