Gerber EDV and AnMaXX host Qrypter Adwind C&Cs
Researchers uncovered fake hosting providers Gerber EDV and AnMaXX operating from the same infrastructure to provide botnet hosting for Qrypter MaaS distributing Adwind RAT and other malware.
In an investigation spanning August 2017 to April 2018, researchers identified nearly 10,000 Adwind RAT samples communicating with over 2,800 command-and-control servers, with the majority linked to the Qrypter Malware-as-a-Service platform. The Qrypter MaaS operates through the Tor network for resilience, while its actual C&C infrastructure resides in clear-net hosting, primarily in the United States, Netherlands, and Great Britain.
Two hosting providers emerged as primary facilitators: AnMaXX and Gerber EDV-Dienstleistungen. Both networks share the same IP address (78.47.229.243) and mail server infrastructure, suggesting common ownership. Gerber EDV advertises itself as a "non-logging VPN service" with offices registered in Bern, Switzerland. However, physical verification revealed no company exists at the registered address (Junkerngasse 44), and Swiss business registries contain no record of the entity. The RIPE database entries for both organizations contain falsified information.
The investigation reveals these networks exist solely to provide bulletproof hosting for botnet controllers associated with Qrypter MaaS, Adwind RAT, NanoCore, and RemcosRAT. Researchers identified dozens of IP ranges across multiple ASNs controlled by these operators and recommend blocking all associated network prefixes. The abuse of RIPE's registration system highlights gaps in verification processes for network resource allocation.
Mentioned in this report
Detection guidance
Java Process Executing JAR from User Temp/AppData (Adwind/Qrypter Loader Pattern)
Detects java.exe/javaw.exe launching a JAR file from user-writable temp or AppData paths, a common execution pattern for Adwind RAT delivered via Qrypter after spearphishing attachment. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Java Process Executing JAR from Temp or AppData Directory
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \java.exe
- \javaw.exe
CommandLine|contains: -jar
suspicious_path:
CommandLine|contains:
- \AppData\Local\Temp\
- \AppData\Roaming\
- \Temp\
- \Users\Public\
filter:
CommandLine|contains:
- \Program Files\
- \Program Files (x86)\
condition: selection and suspicious_path and not filter
falsepositives:
- Legitimate Java applications installed or updated into user profile folders
- Developer tools that unpack and run JARs from temp locations during build/test
level: medium
tags:
- attack.t1566.001
- attack.t1219
id: 1fb9569c-494a-5ac5-8ad9-90b5b7c24c81
status: experimental
author: Vorant
Persistence via Run Key Pointing to Java or Script Interpreter (Adwind RAT)
Detects creation of an autorun Registry Run/RunOnce value referencing javaw.exe, java.exe, wscript.exe or cscript.exe, a persistence mechanism used by Adwind/Qrypter RAT after initial infection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Autorun Registry Key Referencing Java or Script Host Executable
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains:
- \Software\Microsoft\Windows\CurrentVersion\Run
- \Software\Microsoft\Windows\CurrentVersion\RunOnce
suspicious_value:
Details|contains:
- javaw.exe
- java.exe
- wscript.exe
- cscript.exe
condition: selection and suspicious_value
falsepositives:
- Legitimate Java-based software (e.g., business apps, IDEs) configuring auto-start
entries
- IT-deployed login scripts using wscript/cscript for legitimate automation
level: medium
tags:
- attack.t1219
- attack.persistence
id: 2438fdc4-0147-5294-88f3-6d9b124fb156
status: experimental
author: Vorant
Script Interpreter Spawning Java Process (Adwind RAT Attachment Execution Chain)
Detects wscript.exe or cscript.exe spawning javaw.exe/java.exe, matching the execution chain typically seen when a spearphished script/JAR dropper launches the Adwind RAT payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WScript or CScript Spawning Java Process
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \wscript.exe
- \cscript.exe
Image|endswith:
- \java.exe
- \javaw.exe
condition: selection
falsepositives:
- Legitimate administrative or logon scripts that invoke Java-based utilities
- Software installers using VBScript wrappers to launch Java setup routines
level: medium
tags:
- attack.t1566.001
- attack.t1219
id: 1ecef8f4-a866-52c1-9539-fec288e86db2
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://abuse.ch/blog/anmaxx-gerber-edv-and-the-qrypter-connection
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free