Adwind

Overview

Backdoor:Java/Adwind (also known as AlienSpy, Frutas, and jRAT) is a highly prolific, commercially available **Remote Access Trojan (RAT)** written entirely in the Java programming language. Because it relies on the Java Virtual Machine (JVM), Adwind is fundamentally **cross-platform**. A single malicious `.jar` file can seamlessly execute and infect Windows, macOS, Linux, and even Android environments without requiring the attacker to recompile the payload.

Understanding the Adwind Threat
To an end-user, the infection is typically invisible, occurring after opening a deceptive email attachment. For an enterprise, Adwind represents a total compromise of the affected endpoint, granting the attacker full, interactive control. It is frequently sold as Malware-as-a-Service (MaaS) on underground forums, making it accessible to both low-level cybercriminals and advanced APT groups.

Execution and Cross-Platform Surveillance
Adwind is heavily distributed via massive spam campaigns (`T1566.001`), often disguised as invoices or shipping documents (e.g., `invoice.jar`). When the user executes the file (assuming Java is installed) (`T1204.002`), Adwind unpacks itself in memory. It establishes persistence appropriate to the host OS (e.g., Registry Run keys on Windows, `LaunchAgents` on macOS) (`T1547.001`). Once active, it connects to a C2 server (often utilizing dynamic DNS) (`T1071.001`). The attacker can then utilize the RAT's extensive features: keylogging (`T1056.001`), stealing saved passwords from browsers and FTP clients (`T1555`), capturing webcam/microphone streams (`T1125`), and downloading additional modules.

Indicators of Compromise & Impact
The primary impact is the complete loss of confidentiality and control over the endpoint. Host-based IoCs include EDR alerts for `java.exe` or `javaw.exe` spawning unexpected child processes or making anomalous outbound network connections. The presence of hidden `.jar` or `.class` files in the `%AppData%` or `~/Library/Application Support` directories is a strong indicator. Network IoCs include encrypted TCP traffic over non-standard ports communicating with known dynamic DNS providers.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.
• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.
• T1125: Restrict access to local camera or microphone APIs. Utilize endpoint protection that monitors hardware access.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_ADWIND {
    meta:
        description = "Detects Adwind (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "adwind" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Adwind Activity
id: 0f38d1a4b51b0d590b89cbb3086f4ab9
status: experimental
description: Detects generic indicators of the adwind malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*adwind*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the endpoint from the network to sever the attacker's interactive control session.
2. Force a password reset for all corporate accounts used on the machine, as the keylogger likely captured them.
3. Verify the infection vector (usually email) and purge the malicious `.jar` attachment from all corporate inboxes to prevent lateral spread.
4. Consider uninstalling the Java Runtime Environment (JRE) from all endpoints that do not strictly require it for business operations.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume macOS or Linux endpoints are immune; Adwind's primary strength is its ability to infect any OS with Java installed.
2. Avoid relying solely on file hashes, as Adwind builders allow attackers to easily generate unique, obfuscated `.jar` files.

References & External Analysis

• Search "adwind" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Polip
• Exxroute
• Proxyagent
• Yakes
• Exebinder

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/adwind.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.