Adwind RAT C2s traced to AnMaXX hosting

Cross-platform Java RAT Adwind (jRAT/JSocket), sold as malware-as-a-service, is spreading via spam and using bulletproof-style hosting from a provider dubbed AnMaXX.

Adwind, also known as jRAT or JSocket, is a Java-based remote access trojan capable of infecting Windows, macOS, Linux, and Android systems as long as a Java runtime is present. Active since 2012 and gaining traction over the past several years, the malware has been distributed as malware-as-a-service through the JSocket.org platform, offering subscribers AV evasion, VPN services, and technical support. Primary infection occurs through spam emails carrying ZIP archives with malicious .jar files or links to download URLs serving the payload, and Trend Micro previously reported enterprise and industrial targeting involving Adwind in early 2017.

The researcher identified dozens of Adwind botnet command-and-control servers hosted across 17 IP prefixes rented and operated by a hosting entity referred to as "AnMaXX," which does not announce its own AS but leases IP space from various providers across multiple countries (Switzerland, Norway, Russia, Romania, UK, Macedonia, France, Netherlands, Germany, Serbia, Czech Republic). Two of the listed WHOIS records share the same registrant email address, suggesting common control over portions of this infrastructure. The advisory recommends organizations monitor outbound traffic to these prefixes (excluding ports 80/443 to reduce false positives) as an indicator of Adwind infection within their networks.

title: Execution of JAR File from Email Attachment or Temp Directory
description: Detects Java runtime spawning to execute JAR files stored in paths commonly
  associated with email attachments or user downloads. Adwind typically arrives as
  a ZIP containing .jar files opened directly by users.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \java.exe
    - \javaw.exe
    CommandLine|contains:
    - .jar
  selection_path:
    CommandLine|contains:
    - \Temp\
    - \AppData\Local\Temp\
    - \Downloads\
    - TEMP\\
  filter_legitimate:
    CommandLine|contains:
    - eclipse
    - netbeans
    - gradle
    - maven
  condition: selection and selection_path and not filter_legitimate
falsepositives:
- Developers executing JAR files from temp directories during testing or build processes
- Java-based application installers
level: medium
id: 443bbea4-3b58-5b0a-9b15-9fcf63a33b4e
status: experimental
author: Vorant

title: ZIP Archive Containing JAR Extracted and Executed from Email Temp
description: Detects the characteristic Adwind delivery pattern - extraction of a
  ZIP archive from an email client's temp directory followed immediately by java.exe
  executing the extracted JAR file. Focuses on the parent-child process relationship
  and staging paths rather than specific filenames.
tags:
- attack.initial-access
- attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_extraction:
    Image|endswith:
    - \explorer.exe
    - \winrar.exe
    - \7z.exe
    CommandLine|contains:
    - .zip
    ParentCommandLine|contains:
    - Temp\\
    - AppData\\Local\\Temp\\
  selection_java_child:
    ParentImage|endswith: \explorer.exe
    Image|endswith:
    - \java.exe
    - \javaw.exe
    CommandLine|contains: .jar
  filter_admin_extraction:
    User|contains:
    - SYSTEM
    - Administrator
  condition: (selection_extraction or selection_java_child) and not filter_admin_extraction
falsepositives:
- Legitimate software distribution via ZIP in email requiring manual extraction and
  execution
- IT support tools deployed this way
level: high
id: a70e2e8e-6bb8-56bb-8c98-9b58c4ebe4c8
status: experimental
author: Vorant

Source reporting: https://abuse.ch/blog/adwind-a-cross-plattform-rat