Netwire

Netwire is an advanced RAT — it is a malware that takes control of infected PCs and allows its operators to perform various actions. Unlike many RATs, this one can target every major operating system, including Windows, Linux, and MacOS.

Type
Trojan
Origin
ex-USSR territory
First seen
1 January, 2012
Last seen
5 October, 2022
Also known as
Recam
Global rank
21
Week rank
20
Month rank
17
IOCs
6704

What is Netwire RAT?

Netwire is a remote access trojan-type malware. A RAT is malware used to control an infected machine remotely. This particular RAT can perform over 100 malicious actions on infected machines and can attack multiple systems, including Windows, Apple’s MacOS, and Linux.

Netwire malware is available for purchase on the darknet in the underground hacking communities, where attackers can buy this RAT for the price of 40 to 140 USD. In addition, Netwire can be purchased on the surface internet for a price of 180 USD. Notably, in 2016 Netwire received an update that added the functionality to steal data from devices connected to the infected machine, such as USB credit card readers, allowing Netwire to perform POS attacks.

General description of Netwire RAT

Netwire Trojan core functionality allows this malware to take remote control of infected PCs, record keyboard strokes and mouse behavior, take screenshots, check system information, and create fake HTTP proxies.

The keylogger functionally allows Netwire to record various personal data imputed on a computer connected to the internet or a corporate network. Combined with the ability to steal credit card information and operate undetected for extended periods of time, Netwire RAT is truly capable of inflicting serious dangers to organizations.

In some malicious campaigns, the Netwire trojan was used to target healthcare and banking businesses. The malware was also documented as being used by a group of scammers from Africa who utilized Netwire to take remote control of infected machines.

Netwire RAT creators have put in a lot of work to ensure that researchers have a hard time analyzing this malware, as many precautions are taken to complicate the research process, including techniques like multiple data encryption layers and string obfuscation. In addition, the malware uses a custom C2 binary protocol that is also encrypted, and so is the relevant data before transmission.

During one campaign, researchers have observed Netwire being distributed as “TeamViewer 10” – named so in an effort to trick victims into thinking that they have downloaded the legitimate remote assistance software. Once the execution process began, this version would drop an .EXE file and start establishing persistence right away. The malware created a Windows shortcut in the Startup menu to ensure that the Netwire trojan would always run when the user logged into the system. Interestingly, another trick designed to keep the malware hidden actually gave it away during this particular campaign. The malware would inject its code into the Notepad.exe, unveiling its presence since it’s not normal for the notepad to have an always active network connection. Only after decoding the data prepared for transmission to the C2, the sensitive nature of the stolen information was discovered. Unfortunately, researches did not reveal what the organization was targeted in this particular attack.

Netwire RAT malware analysis

A video simulation recorded on ANY.RUN enables researchers to study the lifecycle of the Netwire in a lot of detail and works like a tutorial.

process graph of the Netwire execution Figure 1: Process graph generated by ANY.RUN allows visualizing the life cycle of Netwire

a text report of a netwire analysis Figure 2: A text report generated by ANY.RUN is a great tool to share the research results

Netwire RAT execution process

Netwire isn't as exciting as some other malicious programs can be as far as malware execution goes. It makes its way into the device, mostly in the form of a payload.

The user receives a spam email with an attached Microsoft Word file. After the user downloads and opens this file, the executable is dropped or downloaded onto the machine. After that, the executable starts performing the main malicious activity such as writing itself in autorun, connecting to C2 servers, and stealing information from an infected device. Netwire also has the ability to inject into unsuspicious processes from which it can perform malicious activities.

Distribution of Netwire RAT

Netwire RAT is usually being distributed in email phishing campaigns in the form of a malicious Microsoft Office document. The victim must enable macros for the RAT to enter an active state. The macros then proceed to download Netwire, allowing the malware to start the execution process.

How to export Netwire data using ANY.RUN?

If analysts want to do additional work with events from tasks or share them with colleagues for tutorials, they can export to different formats. Just click on the "Export" button and choose the most suitable format in the drop-down menu. Export of any kind of malware research is available including Predator the Thief or Qbot.

Export options for netwire malware Figure 3: Export options for netwire malware

Conclusion

Diverse information stealing feature sets combined with the ability to target multiple operating systems and steal data from credit cards used in an infected system make Netwire Trojan a highly dangerous remote access trojan.

Despite its impressive functionality, the malware is fairly accessible, “retailing” on underground forums for as little as 40 dollars in some select cases. The situation is further worsened by the fact that creators of Netwire RAT have implemented several features designed to complicate the analysis as much as possible.

However, researchers can take advantage of interactive malware hunting services, such as ANY.RUN, which allows to influence the simulation at any point and get much purer research results.

IOCs

IP addresses
94.237.28.110
194.5.98.48
185.183.98.166
185.222.57.164
185.213.155.165
194.5.98.188
194.31.98.108
171.22.30.21
185.140.53.252
194.147.140.4
87.66.106.20
71.81.62.106
31.41.244.150
154.118.25.216
79.134.225.28
104.168.148.85
154.53.40.254
185.140.53.61
79.134.225.10
79.134.225.119
Hashes
8a3a10f54b14af443b8bca10829279d75bca774730065b209296171633fc2a07
5f2a513bb02d1432e658ac0d65327d0ed56f6a4f1e014de8e4ff50fcf738ca93
6dd20082faf4c07f30a39327695ec299b02431c6c80f7fdb93b7de163cf4581a
849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e
43092b2993c9d9cfab01aa340bc378cad547ae0938c6803cb580271139798765
8970349251f2b74bcd42987611b34ffa62bc767569d750084474bf49c2894f72
6e8bf76b6d1f39b8366169c0cd6dc4bee0946973b8f5c64baf7fd1bfd1846731
53944a881741bee915b91916abf91bb7916f89756ee49dc2bc8e8ba768213c16
702a898f99fdcf56d29f5a9d4c54794c09880f7b000488a1f9f4c2259e520bee
9b3f1eb00897b938a2417a235f12b7d3eeb1360a6559fca8f12564ff37d72ee1
2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
35d0bbb6787ae3fb3e155f2eaad36e5f4bb5255e7bb95b759790cc3cc048839d
87ce6467d71023d696315cd06d578f2a17218012beba5502744779614fc67f08
740dd7485890bdb1eb9d3fce140035356e0c6e85f614d818adcc129b285e14b5
47fe8af42f4b7360f7d6dcd89b161c1bec308d6598c17262d8bf234e1871b39a
a2a0a4b91cbcf08126c70586521d2e7a0d6cf744058c314ffced7bdce97a40a1
9b69c34effa0bda4b3d14deeae93743267cdeac6a2501f2a44cbbe4ac6dcdce2
dea5e81974a13803ab09d7b27bf04e5a22c35ced5ce8d94a4552eade6b2a76db
b753b5997557c0cd4758e3731da45e07b2836fd2fd4bc3a7d5e575e98a083aba
86d278bf55d25df08ce3b1c46513c6e38da84bf143a059bdbb53c91c564ae211
Domains
frederikkempe.com
majul.com
elx01.knas.systems
WindowsAuthentication324-49629.portmap.host
537a-41-143-187-7.ngrok.io
f0ed-2a10-8006-18e0-0-24c3-abef-18b9-7871.ngrok.io
60abf116c991.ngrok.io
fc648a51db86.ngrok.io
8ef628b4602c.ngrok.io
e644e4bcb557.ngrok.io
c750b8f7716c.ngrok.io
428b74e31b0f.ngrok.io
df2745379814.ngrok.io
52e0ff58833f.ngrok.io
acf7d370510d.ngrok.io
ce47174fc1d2.ngrok.io
9ea2ac777bb9.ngrok.io
jcole-lms.ngrok.io
chalakh.ngrok.io
e5927c359c3c.ngrok.io

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Ave Maria screenshot
Ave Maria
avemaria stealer trojan rat
Ave Maria malware is a Remote Access Trojan that is also called WARZONE RAT. Hackers use it to control the PCs of their victims remotely and steal information from infected PCs. For example, they can remotely activate the camera to take pictures of a victim and send them to a control server.
Read More
Azorult screenshot
Azorult
azorult trojan rat
AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.
Read More
Crimson RAT screenshot
Crimson RAT
crimson rat trojan
Crimson is a Remote Access Trojan — a malware that is used to take remote control of infected systems and steal data. This particular RAT is known to be used by a Pakistani founded cybergang that targets Indian military objects to steal sensitive information.
Read More
Danabot screenshot
Danabot
danabot trojan stealer
Danabot is an advanced banking Trojan malware that was designed to steal financial information from victims. Out of the Trojans in the wild, this is one of the most advanced thanks to the modular design and a complex delivery method.
Read More