Java/Adwind [Threat Name] go to Threat
Java/Adwind.UA [Threat Variant Name]
| Category | trojan |
| Size | 81099 B |
| Aliases | Trojan.Java.Generic (Kaspersky) |
Short description
Java/Adwind.UA serves as a backdoor. It can be controlled remotely.
Installation
When executed, the trojan copies itself in some of the the following locations:
- %appdata%\%variable1%\%variable2%.%variable3% (Microsoft Windows)
- %userhome%/variable1%/%variable2%.%variable3% (Linux)
- %userhome%/variable1%/%variable2%.%variable3% (Mac OS X)
The trojan may set the following Registry entries:
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
- "%variable4%" = "%jrepath% -jar %malwarefilepath%"
- [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
- "%variable4%" = "%jrepath% -jar %malwarefilepath%"
A string with variable content is used instead of %variable1-4% .
The trojan may create the following files:
- %userhome%/.config/autostart/%variable4%.desktop (Linux)
- %userhome%/Library/LaunchAgents/com.%variable4%.plist (Mac OS X)
This causes the trojan to be executed on every system start.
The trojan creates the following files:
- %appdata%\variable1%\Desktop.ini
Information stealing
The trojan collects the following information:
- computer IP address
- MAC address
- memory status
- user name
- computer name
- operating system version
- opened port number
- country code
- country
- malware version
The trojan attempts to send gathered information to a remote machine.
Other information
The trojan acquires data and commands from a remote computer or the Internet.
The trojan contains a URL address. The TCP protocol is used in the communication.
It can execute the following operations:
- download files from a remote computer and/or the Internet
- run executable files
- update itself to a newer version
- open a specific URL address
- display a dialog window
- capture screenshots
- various filesystem operations
- uninstall itself
The trojan terminates its execution if it detects that it's running in a specific virtual environment.
The trojan may create the following files:
- %temp%\wmplog11.png
- %temp%\wowlog.png
- %temp%\ukjaslmqwplaskmzmcnvbv.%variable%
A string with variable content is used instead of %variable% .