AdWind

Internal ID: jar.adwind

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Part of Malware-as-service platform

Used as a generic name for Java-based RAT

Functionality

- collect general system and user information

- terminate process

-log keystroke

-take screenshot and access webcam

- steal cache password from local or web forms

- download and execute Malware

- modify registry

- download components

- Denial of Service attacks

- Acquire VPN certificates

Initial infection vector

1. Email to JAR files attached

2. Malspam URL to downlaod the malware

Persistence

- Runkey - HKCU\Software\Microsoft\Windows\current version\run

Hiding

Uses attrib.exe

Notes on Adwind

The malware is not known to be proxy aware

Threat Analysis

AdWind is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→http://blog.trendmicro.com/trendlabs-security-intelligence/spam-remote-access-trojan-adwind-jrat

→http://malware-traffic-analysis.net/2017/07/04/index.html

→https://blog.talosintelligence.com/2018/09/adwind-dodgesav-dde.html

→https://blogs.seqrite.com/evolution-of-jrat-java-malware/

→https://citizenlab.ca/2015/12/packrat-report/

→https://dissectingmalware.blogspot.com/2018/08/export-jratadwind-config-with-x32dbg.html

→https://gist.github.com/herrcore/8336975475e88f9bc539d94000412885

→https://marcoramilli.com/2018/08/20/interesting-hidden-threat-since-years/

→https://research.checkpoint.com/malware-against-the-c-monoculture/

→https://threatresearch.ext.hp.com/javascript-malware-dispensing-rats-into-the-wild/

Quick Facts

TypeAPT / Threat Group

Aliases1

Also Known As

jar.adwind

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search AdWind