jRAT
MITRE ATT&CK: S0283 View on attack.mitre.org
Aliases: JSocket, AlienSpy, Frutas, Sockrat, Unrecom, jFrutas, Adwind, jBiFrost, Trojan.Maljava, JBifrost, UNRECOM, Jacksbot, jRAT, UNiversal REmote COntrol Multi-Platform, Jsocket, JacksBot
- First seen
- 2012-01-01 00:00:00
- Malware type
- rat, backdoor, spyware, trojan
- Family
- Malware family
- Operating systems
- linux, windows, macos, android
- Related IoCs
- 174 (138 malicious)
- Last IoC activity
- 2026-09-02 02:27:49
- Profile updated
- 2026-07-07 15:45:56
Targeted industries: financial-services government-and-public-sector technology-and-telecommunications
Context
jRAT is a cross-platform, Java-based backdoor originally available for purchase in 2012. Variants of jRAT have been distributed via a software-as-a-service platform, similar to an online subscription model.
Recent IoC activity
139 malicious indicators in Maltiverse are attributed to jRAT (S0283). The 20 most recently updated:
Detection coverage
- 478 Sigma rules
Malware & tools used
- Keylogging (attack-pattern)
- Peripheral Device Discovery (attack-pattern)
- Scheduled Transfer (attack-pattern)
- Windows Management Instrumentation (attack-pattern)
- Visual Basic (attack-pattern)
- Video Capture (attack-pattern)
- Windows Command Shell (attack-pattern)
- System Service Discovery (attack-pattern)
- File Deletion (attack-pattern)
- System Information Discovery (attack-pattern)
- Startup Items (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- Process Discovery (attack-pattern)
- File and Directory Discovery (attack-pattern)
- Remote Desktop Protocol (attack-pattern)
- Credentials from Web Browsers (attack-pattern)
- Software Packing (attack-pattern)
- Security Software Discovery (attack-pattern)
- Proxy (attack-pattern)
- JavaScript (attack-pattern)
- Clipboard Data (attack-pattern)
- Credentials In Files (attack-pattern)
- Audio Capture (attack-pattern)
- Screen Capture (attack-pattern)
- System Network Connections Discovery (attack-pattern)
Used by threat actors
- TA2541 (threat-actor)
Reports & references
- ncsc.gov.uk — Joint%20Report%20On%20Publicly%20Available%20Hacking%20Tools%20%28Ncsc%29 (report)
- citizenlab.ca — Packrat Report (report)
- malpedia.caad.fkie.fraunhofer.de — Jar.Adwind (report)
- blogs.seqrite.com — Evolution Of Jrat Java Malware (report)
- zscaler.com — Compromised Wordpress Sites Used Distribute Adwind Rat (report)
- spamhaus.org — 2020 Q2 Spamhaus Botnet Threat Report (report)
- Trend Micro — Ssl Tls Technical Brief (report)
- Trend Micro — Spam Remote Access Trojan Adwind Jrat (report)
- dissectingmalware.blogspot.com — Export Jratadwind Config With X32Dbg (report)
- Cisco Talos — Adwind Dodgesav Dde (report)
- gist.github.com — 8336975475E88F9Bc539D94000412885 (report)
- marcoramilli.com — Interesting Hidden Threat Since Years (report)
- threatresearch.ext.hp.com — Javascript Malware Dispensing Rats Into The Wild (report)
- fortinet.com — New Jrat Adwind Variant Being Spread With Package Delivery Scam (report)
- securityinbits.com — Interesting Tactic By Ratty Adwind Distribution Of Jar Appended To Signed Msi (report)
- research.checkpoint.com — Malware Against The C Monoculture (report)
- malware-traffic-analysis.net — Index (report)
- malpedia.caad.fkie.fraunhofer.de — Jar.Jrat (report)
- Trend Micro — Jacksbot Has Some Dirty Tricks Up Its Sleeves (report)
- maskop9.wordpress.com — Analysis Of Jacksbot Backdoor (report)
- intego.com — New Multiplatform Backdoor Jacksbot Discovered (report)
- eff.org — Operation Manul (report)
- MITRE ATT&CK — S0283 (report)
- media.kasperskycontenthub.com — Kl Adwindpublicreport 2016 (report)
- ncsc.gov.uk — Joint Report On Publicly Available Hacking Tools (report)
External references
- mitre-attack — S0283
- jRAT
- Trojan.Maljava
- JSocket
- AlienSpy
- Frutas
- Sockrat
- Unrecom
- jFrutas
- Adwind
- jBiFrost
- Kaspersky Adwind Feb 2016
- jRAT Symantec Aug 2018
- NCSC Joint Report Public Tools
- misp-galaxy
- misp-galaxy
- misp-galaxy
- misp-galaxy
- misp-galaxy
- misp-galaxy