Skip to content

jRAT

Software · ATTACK:enterprise:S0283

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0283",
  "title": "jRAT",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0283",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--efece7e8-e40b-49c2-9f84-c55c5c93d05c",
  "external_id": "S0283",
  "domain": "enterprise",
  "created": "2018-10-17T00:14:20.652Z",
  "modified": "2023-10-03T19:38:43.114Z",
  "version": "2.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "jRAT"
    },
    {
      "source_name": "Trojan.Maljava"
    },
    {
      "source_name": "JSocket"
    },
    {
      "source_name": "AlienSpy"
    },
    {
      "source_name": "Frutas"
    },
    {
      "source_name": "Sockrat"
    },
    {
      "source_name": "Unrecom"
    },
    {
      "source_name": "jFrutas"
    },
    {
      "source_name": "Adwind"
    },
    {
      "source_name": "jBiFrost"
    },
    {
      "source_name": "Kaspersky Adwind Feb 2016",
      "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07195002/KL_AdwindPublicReport_2016.pdf"
    },
    {
      "source_name": "jRAT Symantec Aug 2018",
      "url": "https://www.symantec.com/blogs/threat-intelligence/jrat-new-anti-parsing-techniques"
    },
    {
      "source_name": "NCSC Joint Report Public Tools",
      "url": "https://www.ncsc.gov.uk/report/joint-report-on-publicly-available-hacking-tools"
    }
  ]
}

Explicit source assertions (29)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b9a4cdc-8305-49ec-879f-6cfa35763af2

jRAT Symantec Aug 2018 · Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c93519a-28a4-4d29-99bc-02c4d0e53ae2

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d7811d3-d4ee-4114-b841-c0463f2274be

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1157b635-1cd6-4f65-9be6-09a9f7ac1664

jRAT Symantec Aug 2018

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--149f62ba-b5c1-4dcb-b677-a45b72cf5d7b

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2043a8a7-d365-4f5c-9ee3-5b9be710f14d

jRAT Symantec Aug 2018 · Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b2ccd03-b6ad-4125-a05d-851ebf353bb5

Kaspersky Adwind Feb 2016

ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:S0283

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b6a298e-f389-412e-8ff1-27028baabccc

Proofpoint TA2541 February 2022

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40da5ea7-b4d1-45a4-944e-c1c74e408086

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--417552c3-3db4-491a-86bb-7fe2c513d406

jRAT Symantec Aug 2018

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e6c5e8c-96a2-4da8-869a-56fe224e037e

Symantec Frutas Feb 2013

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1037.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68f6cc6d-b90b-4a56-a867-99b3a2786b11

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--730190b3-d372-4461-9bf4-94de4c078968

jRAT Symantec Aug 2018 · Kaspersky Adwind Feb 2016 · Symantec Frutas Feb 2013

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c1e2638-ca07-4825-b7e8-43690912ce74

Symantec Frutas Feb 2013

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7de1c513-5141-45ed-aeb0-b1b221f4dc3f

Kaspersky Adwind Feb 2016 · Symantec Frutas Feb 2013

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7fc56f31-3cf9-411c-a6a2-79bbaab13f29

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--890f944f-190d-456d-b194-f5ecb17a0868

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89210061-1ce3-4fdf-af84-2afee2062296

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e685821-98a3-42a0-9c6a-334a8ff078d4

jRAT Symantec Aug 2018 · Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8fd75064-d1b8-4b8c-b9ea-5b65a1cc0ea8

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1059.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a28ed204-7e5c-4090-a0c5-0a056ef602fe

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac3fb8d5-9d9d-4701-a269-53e838850d71

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1108137-b707-4358-b4b2-b2f139418f7e

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cdd356f2-bd44-497c-b02d-30ad9ed869a2

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea2f957a-b144-4f06-b3fe-891df62f9444

jRAT Symantec Aug 2018 · Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eb808671-1f29-4e76-9433-b50176abf60a

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ec2e27c9-71fe-4650-a5b9-1247193c39f6

jRAT Symantec Aug 2018 · Symantec Frutas Feb 2013

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ef97d2bb-7e5a-4c3b-8e7d-cc4fb098c47d

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fe720085-2a43-4f72-8a5f-cf6ae82f7127

Kaspersky Adwind Feb 2016

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.