Backdoor.Adwind

By Sumo3000 in Backdoors

Threat Scorecard

Threat Level:	60 % (Medium)
Infected Computers:	505

First Seen:	July 23, 2013
Last Seen:	October 25, 2022
OS(es) Affected:	Windows

Backdoor.Adwind is a backdoor Trojan that opens a back door on the compromised PC, steals information, and may distribute other malware infections. Backdoor.Adwind may propagate as a malicious spam email attachment. Backdoor.Adwind was generated in Java and can be run on a variety of operating systems, incorporating Windows, Mac OS and Linux. Once run, Backdoor.Adwind creates the infected files. Backdoor.Adwind opens a back door on the infected computer and connects to the specific URLs. Backdoor.Adwind can be built with a kit and can be set to access any URL. Backdoor.Adwind may execute the damaging actions, such as access the webcam, access the file system to read, write, or delete files, take screenshots, log keystrokes, drop and execute files, play an audio message, and tamper with the mouse and keyboard.

Table of Contents

SpyHunter Detects & Remove Backdoor.Adwind

File System Details

Backdoor.Adwind may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	lcusmagrlf.txt	79e9dd35aef6558461c4b93cd0c55b76	10
Name: lcusmagrlf.txt MD5: 79e9dd35aef6558461c4b93cd0c55b76 Size: 125.98 KB (125985 bytes) Detections: 10 Path: %SYSTEMDRIVE%\Users\<username>\appdata\roaming\jcwdpuepch Group: Malware file Last Updated: August 23, 2018
2.	unxx0jihww.txt	db46adcfae462e7c475c171fbe66df82	9
Name: unxx0jihww.txt MD5: db46adcfae462e7c475c171fbe66df82 Size: 131.17 KB (131178 bytes) Detections: 9 Path: %SYSTEMDRIVE%\Users\<username>\appdata\roaming\9bor9j6crd Group: Malware file Last Updated: August 23, 2018
3.	B2856B11FF23D35DA2C9C906C61781BA_purchaseorder.jar	b2856b11ff23d35da2c9c906c61781ba	1
Name: B2856B11FF23D35DA2C9C906C61781BA_purchaseorder.jar MD5: b2856b11ff23d35da2c9c906c61781ba Size: 49.08 KB (49084 bytes) Detections: 1 Group: Malware file Last Updated: October 14, 2018
4.	%Temp%\JNativeHook_[RANDOM DIGITS].dll
Name: %Temp%\JNativeHook_[RANDOM DIGITS].dll Type: Dynamic link library Group: Malware file
5.	%UserProfile%\.plugins2\003.server
Name: %UserProfile%\.plugins2\003.server Group: Malware file
6.	%UserProfile%\.plugins2\006.server
Name: %UserProfile%\.plugins2\006.server Group: Malware file
7.	%UserProfile%\.plugins2\009.server
Name: %UserProfile%\.plugins2\009.server Group: Malware file
8.	%UserProfile%\logss
Name: %UserProfile%\logss Group: Malware file
9.	%UserProfile%\.plugins2\002.server
Name: %UserProfile%\.plugins2\002.server Group: Malware file
10.	%UserProfile%\.plugins2\005.server
Name: %UserProfile%\.plugins2\005.server Group: Malware file
11.	%UserProfile%\.plugins2\008.server
Name: %UserProfile%\.plugins2\008.server Group: Malware file
12.	%UserProfile%\Application Data\Iexplorer\Chrome.jar
Name: %UserProfile%\Application Data\Iexplorer\Chrome.jar Group: Malware file
13.	%UserProfile%\.plugins2\001.server
Name: %UserProfile%\.plugins2\001.server Group: Malware file
14.	%UserProfile%\.plugins2\004.server
Name: %UserProfile%\.plugins2\004.server Group: Malware file
15.	%UserProfile%\.plugins2\007.server
Name: %UserProfile%\.plugins2\007.server Group: Malware file
16.	%UserProfile%\Application Data\Iexplorer\Desktop.ini
Name: %UserProfile%\Application Data\Iexplorer\Desktop.ini Group: Malware file
17.	file.jar	88891dcf0c9e9cb66176db351efdef54	0
Name: file.jar MD5: 88891dcf0c9e9cb66176db351efdef54 Size: 512.84 KB (512848 bytes) Detections: 0 Group: Malware file Last Updated: February 21, 2017
18.	file.exe	d8e2d73f50e8e13acca5f60abf78ee4d	0
Name: file.exe MD5: d8e2d73f50e8e13acca5f60abf78ee4d Size: 604.2 KB (604206 bytes) Detections: 0 Type: Executable File Group: Malware file Last Updated: June 13, 2017
19.	file.exe	8d62519a1654b6cc8dc01b5a69b65162	0
Name: file.exe MD5: 8d62519a1654b6cc8dc01b5a69b65162 Size: 104.18 KB (104186 bytes) Detections: 0 Type: Executable File Group: Malware file Last Updated: July 12, 2017

URLs

Backdoor.Adwind may call the following URLs:

pepepepe.myvnc.com

Enigma Software Group Prevails Over Malwarebytes at the Ninth Circuit

Search

Change Region

Backdoor.Adwind

Threat Scorecard

EnigmaSoft Threat Scorecard

SpyHunter Detects & Remove Backdoor.Adwind

File System Details

URLs

Submit Comment

Trending

Rzfu Ransomware

'YouPorn' Email Scam

Rzkd Ransomware

Most Viewed

Is Lookmovie.io Safe?

How To Fix 'Printer Driver is Unavailable' Error

Discord Shows Black Screen when Sharing Screen