jRAT

MITRE ATT&CK: S0283 View on attack.mitre.org

Aliases: JSocket, AlienSpy, Frutas, Sockrat, Unrecom, jFrutas, Adwind, jBiFrost, Trojan.Maljava, JBifrost, UNRECOM, Jacksbot, jRAT, UNiversal REmote COntrol Multi-Platform, Jsocket, JacksBot

First seen
2012-01-01 00:00:00
Malware type
rat, backdoor, spyware, trojan
Family
Malware family
Operating systems
linux, windows, macos, android
Related IoCs
174 (138 malicious)
Last IoC activity
2026-09-02 02:27:49
Profile updated
2026-07-07 15:45:56

Targeted industries: financial-services government-and-public-sector technology-and-telecommunications

Context

jRAT is a cross-platform, Java-based backdoor originally available for purchase in 2012. Variants of jRAT have been distributed via a software-as-a-service platform, similar to an online subscription model.

Recent IoC activity

139 malicious indicators in Maltiverse are attributed to jRAT (S0283). The 20 most recently updated:

TypeIndicatorUpdatedSources
hostname bibtehnika.in.ua 2026-09-03 2
hostname blackhills.ddns.net 2026-09-02 3
hostname pnauco5.ddns.net 2026-09-02 1
URL http://androdome.com/MCR/Autoupdate/MCRLib.jar 2026-09-02 1
hostname androdome.com 2026-09-02 1
file sample 02092026_0227_31082026_324234324234.jar.rar 2026-09-02 1
hostname rdp.netpipe.xyz 2026-09-02 1
file sample d7aea5e775e868c6498127d3d4e6aff3.jar 2026-08-30 1
file sample cwel.exe 2026-08-29 1
file sample SKMBT28321063007131.jar 2026-08-15 1
file sample c97f819dbd9e7a3424d8a0138c8437529c0a705f5eca071e7195513cc5d84fc4 2026-08-12 1
file sample 5b0fea62e6532b7bf239750f32adab0c5386dc37e1d2f9004281847687e1be3e 2026-08-12 1
file sample d0bfa4e324f7f3a4f6dddc20bbe9396e94debc10421710ba55d54b09aec31e07 2026-08-12 1
file sample b0b1199d15957295a7f844d3638397249cfdab6bfea0971ec52af1f14ec6ed02 2026-08-12 1
file sample 04.08.2026 FİYAT TEKLİFİ BEKLENEN ÜRÜN LİSTESİ.jar 2026-08-04 1
file sample Tide.zip 2026-08-03 1
file sample HEEET.jar 2026-08-02 2
file sample Payment_7202020.jar 2026-08-02 1
file sample 779pro.jar 2026-07-30 1
file sample Quotation.jar 2026-07-29 1

Detection coverage

  • 478 Sigma rules

Malware & tools used

  • Keylogging (attack-pattern)
  • Peripheral Device Discovery (attack-pattern)
  • Scheduled Transfer (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • Visual Basic (attack-pattern)
  • Video Capture (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • System Service Discovery (attack-pattern)
  • File Deletion (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Startup Items (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Process Discovery (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Remote Desktop Protocol (attack-pattern)
  • Credentials from Web Browsers (attack-pattern)
  • Software Packing (attack-pattern)
  • Security Software Discovery (attack-pattern)
  • Proxy (attack-pattern)
  • JavaScript (attack-pattern)
  • Clipboard Data (attack-pattern)
  • Credentials In Files (attack-pattern)
  • Audio Capture (attack-pattern)
  • Screen Capture (attack-pattern)
  • System Network Connections Discovery (attack-pattern)

Used by threat actors

Reports & references

  • ncsc.gov.uk — Joint%20Report%20On%20Publicly%20Available%20Hacking%20Tools%20%28Ncsc%29 (report)
  • citizenlab.ca — Packrat Report (report)
  • malpedia.caad.fkie.fraunhofer.de — Jar.Adwind (report)
  • blogs.seqrite.com — Evolution Of Jrat Java Malware (report)
  • zscaler.com — Compromised Wordpress Sites Used Distribute Adwind Rat (report)
  • spamhaus.org — 2020 Q2 Spamhaus Botnet Threat Report (report)
  • Trend Micro — Ssl Tls Technical Brief (report)
  • Trend Micro — Spam Remote Access Trojan Adwind Jrat (report)
  • dissectingmalware.blogspot.com — Export Jratadwind Config With X32Dbg (report)
  • Cisco Talos — Adwind Dodgesav Dde (report)
  • gist.github.com — 8336975475E88F9Bc539D94000412885 (report)
  • marcoramilli.com — Interesting Hidden Threat Since Years (report)
  • threatresearch.ext.hp.com — Javascript Malware Dispensing Rats Into The Wild (report)
  • fortinet.com — New Jrat Adwind Variant Being Spread With Package Delivery Scam (report)
  • securityinbits.com — Interesting Tactic By Ratty Adwind Distribution Of Jar Appended To Signed Msi (report)
  • research.checkpoint.com — Malware Against The C Monoculture (report)
  • malware-traffic-analysis.net — Index (report)
  • malpedia.caad.fkie.fraunhofer.de — Jar.Jrat (report)
  • Trend Micro — Jacksbot Has Some Dirty Tricks Up Its Sleeves (report)
  • maskop9.wordpress.com — Analysis Of Jacksbot Backdoor (report)
  • intego.com — New Multiplatform Backdoor Jacksbot Discovered (report)
  • eff.org — Operation Manul (report)
  • MITRE ATT&CK — S0283 (report)
  • media.kasperskycontenthub.com — Kl Adwindpublicreport 2016 (report)
  • ncsc.gov.uk — Joint Report On Publicly Available Hacking Tools (report)

External references