JDownloader Supply Chain Compromise: Detecting Malicious Installers

---
title: Suspicious Child Process by JDownloader Installer
id: 8a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects JDownloader installer spawning cmd, powershell, or wscript, which is atypical behavior for a standard Java-based installer wrapper.
references:
  - https://www.malwarebytes.com/blog/news/2026/05/attackers-replaced-jdownloader-installer-downloads-with-malware
author: Security Arsenal
date: 2026/05/16
tags:
  - attack.execution
  - attack.t1204
  - attack.initial_access
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - 'JDownloader'
      - 'JDSetup'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate administrative scripting triggered by user (rare for this installer)
level: high
---
title: JDownloader Installer Writing to Persistence Locations
id: 9b3c4d5e-6f7a-5b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects the JDownloader setup process creating executable files in Startup or AppData directories, indicative of malware dropping a payload.
references:
  - https://www.malwarebytes.com/blog/news/2026/05/attackers-replaced-jdownloader-installer-downloads-with-malware
author: Security Arsenal
date: 2026/05/16
tags:
  - attack.persistence
  - attack.t1547
logsource:
  category: file_create
  product: windows
detection:
  selection:
    Image|contains:
      - 'JDownloader'
    TargetFilename|contains:
      - '\ProgramData\'
      - '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\'
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.bat'
      - '.vbs'
  condition: selection
falsepositives:
  - Unlikely, legitimate installers write to Program Files, not hidden Startup folders.
level: high

let TimeFrame = ago(7d);
let Installers = DeviceProcessEvents
| where Timestamp > TimeFrame
| where ProcessVersionInfoOriginalFileName =~ "JDownloader.exe" or FileName =~ "JDownloader*.exe";
DeviceNetworkEvents
| where Timestamp > TimeFrame
| join kind=inner (Installers) on DeviceId, InitiatingProcessProcessId
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemotePort
| order by Timestamp desc

-- Hunt for JDownloader binaries with invalid digital signatures
SELECT FullPath,
       Size,
       Mtime,
       hash(path=OSPath).MD5 AS Hash,
       hash(path=OSPath).SHA256 AS SHA256,
       binary_sig(path=OSPath).Status AS SignatureStatus,
       binary_sig(path=OSPath).SubjectName AS Signer
FROM glob(globs='C:/Users/*/Downloads/JDownloader*.exe')
WHERE binary_sig(path=OSPath).Status != "VALID"
   OR binary_sig(path=OSPath).SubjectName !~ "AppWork"

# JDownloader Compromise Remediation Script
# Checks for suspicious/unsigned JDownloader binaries

$ExpectedSigner = "AppWork"
$SuspiciousFiles = @()
$PathsToScan = @(
    "$env:USERPROFILE\Downloads",
    "$env:PUBLIC\Downloads",
    "C:\Program Files\JDownloader",
    "C:\Program Files (x86)\JDownloader"
)

Write-Host "[*] Scanning for JDownloader executables..."

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        $Files = Get-ChildItem -Path $Path -Filter "JDownloader*.exe" -Recurse -ErrorAction SilentlyContinue
        foreach ($File in $Files) {
            $Sig = Get-AuthenticodeSignature -FilePath $File.FullName
            
            if ($Sig.Status -ne "Valid" -or $Sig.SignerCertificate.Subject -notlike "*$ExpectedSigner*") {
                Write-Host "[!] SUSPICIOUS FILE FOUND: $($File.FullName)" -ForegroundColor Red
                Write-Host "    - Signature Status: $($Sig.Status)"
                Write-Host "    - Signer: $($Sig.SignerCertificate.Subject)"
                $SuspiciousFiles += $File.FullName
            } else {
                Write-Host "[+] File Verified: $($File.FullName)" -ForegroundColor Green
            }
        }
    }
}

if ($SuspiciousFiles.Count -gt 0) {
    Write-Host ""
    Write-Host "[ACTION REQUIRED] Found $($SuspiciousFiles.Count) suspicious files." -ForegroundColor Yellow
    Write-Host "Please isolate these systems and initiate incident response procedures."
    # Optional: Quarantine logic would go here in a fully automated IR context
} else {
    Write-Host "[*] No suspicious JDownloader files found."
}