jRAT

MITRE ATT&CK: S0283 View on attack.mitre.org

Aliases: JSocket, AlienSpy, Frutas, Sockrat, Unrecom, jFrutas, Adwind, jBiFrost, Trojan.Maljava, JBifrost, UNRECOM, Jacksbot, jRAT, UNiversal REmote COntrol Multi-Platform, Jsocket, JacksBot

First seen
2012-01-01 00:00:00
Malware type
rat, backdoor, spyware, trojan
Family
Malware family
Operating systems
linux, windows, macos, android
Related IoCs
255 (206 malicious)
Last IoC activity
2026-10-17 01:59:09
Profile updated
2026-07-07 15:45:56

Targeted industries: financial-services government-and-public-sector technology-and-telecommunications

Context

jRAT is a cross-platform, Java-based backdoor originally available for purchase in 2012. Variants of jRAT have been distributed via a software-as-a-service platform, similar to an online subscription model.

Recent IoC activity

206 malicious indicators in Maltiverse are attributed to jRAT (S0283). The 20 most recently updated:

TypeIndicatorUpdatedSources
hostname androdome.com 2026-10-17 1
hostname matefallsbeta.pages.dev 2026-10-17 1
hostname matefalls.pages.dev 2026-10-17 1
hostname blackhills.ddns.net 2026-10-17 3
hostname str-master.pw 2026-10-17 3
hostname pnauco5.ddns.net 2026-10-16 1
file sample jaffacakes118_Trojan.Java.Adwind.ed.ee5cc909966209e496fa234da256f724 2026-10-16 1
file sample jaffacakes118_HEUR.Trojan.Java.Agent.gen.7f463cc869227299a7399e14882188d2 2026-10-16 1
URL http://androdome.com/MCR/Autoupdate/MCRLib.jar 2026-10-16 1
file sample jaffacakes118_HEUR.Backdoor.Win32.Generic.3ef12fe37b34ac0c24365df8636a7006 2026-10-13 1
file sample jaffacakes118_HEUR.Backdoor.Win32.Agent.gen.cf3a57926e12bf1f8d971963b823b098 2026-10-13 1
file sample 779pro.jar 2026-10-13 1
file sample jaffacakes118_Backdoor.Win32.Androm.nmwt.421cc7821ad2b4573005c9fd45bbb15b 2026-10-12 1
file sample jaffacakes118_HEUR.Trojan.Java.Agent.gen.8878c64bbec1a89b590913f40de86442 2026-10-11 1
file sample malware2_cleaned.jar 2026-10-11 2
file sample jaffacakes118_Trojan-PSW.Win32.Fareit.dtvf.34c8f48e628b26c3dd12939da233d1bb 2026-10-10 1
file sample 0ea04527a2009bc3998e1ea7019ce9db521a00abe9fa88e5e98694be717ac71f 2026-10-10 1
file sample jaffacakes118_HEUR.Trojan.Java.Agent.gen.a11007a922362df7053e4a24c8918b72 2026-10-09 1
file sample 28.05.2021_SIPARIS_LISTESI.doc 2026-10-09 1
file sample 4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019_unsafe 2026-10-07 2

Detection coverage

  • 478 Sigma rules

Malware & tools used

  • Keylogging (attack-pattern)
  • Peripheral Device Discovery (attack-pattern)
  • Scheduled Transfer (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • Visual Basic (attack-pattern)
  • Video Capture (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • System Service Discovery (attack-pattern)
  • File Deletion (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Startup Items (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Process Discovery (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Remote Desktop Protocol (attack-pattern)
  • Credentials from Web Browsers (attack-pattern)
  • Software Packing (attack-pattern)
  • Security Software Discovery (attack-pattern)
  • Proxy (attack-pattern)
  • JavaScript (attack-pattern)
  • Clipboard Data (attack-pattern)
  • Credentials In Files (attack-pattern)
  • Audio Capture (attack-pattern)
  • Screen Capture (attack-pattern)
  • System Network Connections Discovery (attack-pattern)

Used by threat actors

Reports & references

  • citizenlab.ca — Packrat Report (report)
  • ncsc.gov.uk — Joint%20Report%20On%20Publicly%20Available%20Hacking%20Tools%20%28Ncsc%29 (report)
  • MITRE ATT&CK — S0283 (report)
  • media.kasperskycontenthub.com — Kl Adwindpublicreport 2016 (report)
  • ncsc.gov.uk — Joint Report On Publicly Available Hacking Tools (report)
  • Broadcom/Symantec — Jrat New Anti Parsing Techniques (report)
  • Kaspersky — Kl Adwindpublicreport 2016 (report)
  • f-secure.com — Backdoor Java Adwind.Shtml (report)
  • blog.fortinet.com — Jbifrost Yet Another Incarnation Of The Adwind Rat (report)
  • rekings.com — Jrat (report)
  • malpedia.caad.fkie.fraunhofer.de — Jar.Adwind (report)
  • blogs.seqrite.com — Evolution Of Jrat Java Malware (report)
  • zscaler.com — Compromised Wordpress Sites Used Distribute Adwind Rat (report)
  • spamhaus.org — 2020 Q2 Spamhaus Botnet Threat Report (report)
  • Trend Micro — Ssl Tls Technical Brief (report)
  • Trend Micro — Spam Remote Access Trojan Adwind Jrat (report)
  • dissectingmalware.blogspot.com — Export Jratadwind Config With X32Dbg (report)
  • Cisco Talos — Adwind Dodgesav Dde (report)
  • gist.github.com — 8336975475E88F9Bc539D94000412885 (report)
  • marcoramilli.com — Interesting Hidden Threat Since Years (report)
  • threatresearch.ext.hp.com — Javascript Malware Dispensing Rats Into The Wild (report)
  • fortinet.com — New Jrat Adwind Variant Being Spread With Package Delivery Scam (report)
  • securityinbits.com — Interesting Tactic By Ratty Adwind Distribution Of Jar Appended To Signed Msi (report)
  • research.checkpoint.com — Malware Against The C Monoculture (report)
  • malware-traffic-analysis.net — Index (report)

External references