NetWire RCMalware
- netweird
- NETWIRE
- recam
Netwire is a RAT, its functionality seems focused on password stealing and keylogging, but includes remote control capabilities as well. Keylog files are stored on the infected machine in an obfuscated form. The algorithm is: for i in range(0,num_read): buffer[i] = ((buffer[i]-0x24)^0x9D)&0xFFFrom MISP Galaxy
Last reported 2 days ago, by Group-IB5 reports
ATT&CK techniques
6 of 71 · each with the sentence it comes from- T1027Obfuscated Files or Information
“T1027”
- T1027.007Dynamic API Resolution
“Dynamic API resolution”
- T1053.005Scheduled Task
“T1053.005”
- T1055Process Injection
“T1055”
- T1056.001Keylogging
“T1056.001”
- T1548Abuse Elevation Control Mechanism
“Abuse Elevation Control Mechanism: Bypass User Account Control”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Inside SiriusQT: A Seriously Skilled RAT“The IP 34.41.139.193 belonging to Google Cloud resources has also been observed in past NetWire campaigns.”
-
NETWIRE Dynamic Configuration Extraction“NETWIRE Dynamic Configuration Extraction”
-
NETWIRE Configuration Extractor“NETWIRE Configuration Extractor”
-
Exploring the REF2731 Intrusion Set“PARALLAX loader maldoc campaigns continue to have success delivering the NETWIRE RAT.”
-
Kremlin RATs from Nigeria“…s Threat Intelligence team examined the domains and identified three phishing campaigns that were used to deliver various RATs, such as NetWire or AsyncRAT.”
Indicators in its reports
named in the reports above- protonmail[.]comin 1 report
- 139.28.38[.]235in 1 report
- 149.102.132[.]253in 1 report
- 184.75.221[.]115in 1 report
- 185.136.165[.]182in 1 report
- 185.140.53[.]139in 1 report
- 185.140.53[.]144in 1 report
- 185.140.53[.]154in 1 report
- 185.140.53[.]61in 1 report
- 185.216.71[.]251in 1 report
- 194.36.111[.]59in 1 report
- 194.5.98[.]126in 1 report
- 194.5.98[.]178in 1 report
- 194.5.98[.]188in 1 report
- 194.5.98[.]65in 1 report
- 212.193.29[.]37in 1 report
- 212.193.30[.]230in 1 report
- 213.152.161[.]249in 1 report
- 217.151.98[.]163in 1 report
- 23.105.131[.]166in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.