Adwind RAT C2s traced to AnMaXX hosting
Cross-platform Java RAT Adwind (jRAT/JSocket), sold as malware-as-a-service, is spreading via spam and using bulletproof-style hosting from a provider dubbed AnMaXX.
Sourceabuse.ch — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Adwind, also known as jRAT or JSocket, is a Java-based remote access trojan capable of infecting Windows, macOS, Linux, and Android systems as long as a Java runtime is present. Active since 2012 and gaining traction over the past several years, the malware has been distributed as malware-as-a-service through the JSocket.org platform, offering subscribers AV evasion, VPN services, and technical support. Primary infection occurs through spam emails carrying ZIP archives with malicious .jar files or links to download URLs serving the payload, and Trend Micro previously reported enterprise and industrial targeting involving Adwind in early 2017.
The researcher identified dozens of Adwind botnet command-and-control servers hosted across 17 IP prefixes rented and operated by a hosting entity referred to as "AnMaXX," which does not announce its own AS but leases IP space from various providers across multiple countries (Switzerland, Norway, Russia, Romania, UK, Macedonia, France, Netherlands, Germany, Serbia, Czech Republic). Two of the listed WHOIS records share the same registrant email address, suggesting common control over portions of this infrastructure. The advisory recommends organizations monitor outbound traffic to these prefixes (excluding ports 80/443 to reduce false positives) as an indicator of Adwind infection within their networks.
Mentioned in this report
Detection guidance
Execution of JAR File from Email Attachment or Temp Directory
A behavioural hunt for the technique in general.
Detects java.exe or javaw.exe executing JAR files from typical email client temp directories or Downloads folder - common Adwind infection vector. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Execution of JAR File from Email Attachment or Temp Directory
description: Detects Java runtime spawning to execute JAR files stored in paths commonly
associated with email attachments or user downloads. Adwind typically arrives as
a ZIP containing .jar files opened directly by users.
tags:
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \java.exe
- \javaw.exe
CommandLine|contains:
- .jar
selection_path:
CommandLine|contains:
- \Temp\
- \AppData\Local\Temp\
- \Downloads\
- TEMP\\
filter_legitimate:
CommandLine|contains:
- eclipse
- netbeans
- gradle
- maven
condition: selection and selection_path and not filter_legitimate
falsepositives:
- Developers executing JAR files from temp directories during testing or build processes
- Java-based application installers
level: medium
id: 443bbea4-3b58-5b0a-9b15-9fcf63a33b4e
status: experimental
author: Vorant
ZIP Archive Containing JAR Extracted and Executed from Email Temp
A behavioural hunt for the technique in general.
Detects extraction and execution chain: ZIP file from email temp location followed by java.exe launching a JAR - typical Adwind delivery. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ZIP Archive Containing JAR Extracted and Executed from Email Temp
description: Detects the characteristic Adwind delivery pattern - extraction of a
ZIP archive from an email client's temp directory followed immediately by java.exe
executing the extracted JAR file. Focuses on the parent-child process relationship
and staging paths rather than specific filenames.
tags:
- attack.initial-access
- attack.t1566.001
logsource:
category: process_creation
product: windows
detection:
selection_extraction:
Image|endswith:
- \explorer.exe
- \winrar.exe
- \7z.exe
CommandLine|contains:
- .zip
ParentCommandLine|contains:
- Temp\\
- AppData\\Local\\Temp\\
selection_java_child:
ParentImage|endswith: \explorer.exe
Image|endswith:
- \java.exe
- \javaw.exe
CommandLine|contains: .jar
filter_admin_extraction:
User|contains:
- SYSTEM
- Administrator
condition: (selection_extraction or selection_java_child) and not filter_admin_extraction
falsepositives:
- Legitimate software distribution via ZIP in email requiring manual extraction and
execution
- IT support tools deployed this way
level: high
id: a70e2e8e-6bb8-56bb-8c98-9b58c4ebe4c8
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://abuse.ch/blog/adwind-a-cross-plattform-rat
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,572 reports from 147 sources, 724 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs