BLACK FRIDAY: 2-for-1 offer NOVEMBER 20 - 26 See details
36
Global rank
45 infographic chevron month
Month rank
48
Week rank
0
IOCs

Netwire is an advanced RAT — it is a malware that takes control of infected PCs and allows its operators to perform various actions. Unlike many RATs, this one can target every major operating system, including Windows, Linux, and MacOS.

Trojan
Type
ex-USSR territory
Origin
1 January, 2012
First seen
13 October, 2024
Last seen
Also known as
Recam

How to analyze Netwire with ANY.RUN

Type
ex-USSR territory
Origin
1 January, 2012
First seen
13 October, 2024
Last seen

IOCs

IP addresses
184.75.221.171
213.152.162.181
185.104.184.43
185.140.53.205
174.127.99.159
185.140.53.144
23.95.88.13
190.123.44.137
43.226.229.43
185.82.202.154
213.152.162.170
37.233.101.73
213.152.161.35
213.152.162.94
213.152.162.109
109.232.227.133
213.152.161.211
213.152.180.5
213.152.162.89
213.152.162.104
Hashes
6cc138d608ee3008a55e3e771991125b411c02cd2c3c914193c2b0524f031246
2fd4e8077355537ab184f5e9f8969620224cf8df85aa14119d7f7f97d5f95ccf
07336cc7355b9c4a1553a93d24ebb30a502053339e05ffb57476890d2967b6fc
9d2977e8e247515a58c1a05c3111a05ed3832c9f01e5df39c1ff5717531f421d
812e2389f8663877b542c908e33460ca2e94d055561f4a57f0814f2ff9ea92b5
b56d64ec701ab7c5878f410833e8af2d59f430663aa14c7cccf4baff6f33665b
3647bace25f94430a534aba8aba08a731571ab2ab22f95ac209096e2c32ef81c
24e5603ffb0ada3e79fe774d29fef2619ae1df4c4331042c49b930b1db7d4e77
637e17723ea88878915ba42095680ee5438c22a88a4538137b3174dd4e2e8c6a
59fc44577bd89c7f6ae86b0b13e7e19c4d17612b4d5696e6c70d2e88d5d8115e
bc3bae79f4f606cb12b4f92361d9d79afa19acbd8c611acc9109da26172da938
869fa23919d381e4af0d8c04881d65ad842cb96020da5c1e16f65c48190d3eef
1c92101d36daaa607f72c5110228680e5d6b8b6636b9b78bad6fe4cba157683d
2cc249a2be6c8f60714f21e8d0b4d4dc6cbda4cde7acfbfbfc1fca9e93778d84
eeec2f71b05b8a71de011e002adf1c9c3b6da84c12517184bfe0b3ccf04d1a56
1cc44e0f214cbf72c836dcbd1b1e67ad574bba62873f974432ee076072bf42cc
e3e9f6286b9203402802576a1ebb67caa43498330dd44ae92b159738ab1915ab
2d0c860613db9a591f52c7bd9b2e7765e8361f48b76604a547018eb0a42021fc
25cf559d1de914a23563ad710eb291840283e5e9963b3941e51799220cc09ea5
3d8f8701d2e460d4ffd915ea185cc03e742693a4a91bca5accedd4b3748870b6
Domains
mediafire.duckdns.org
wallou.publicvm.com
wealthyme.ddns.net
wealthy2019.com.strangled.net
pentester0.accesscam.org
vbchjfssdfcxbcver.ru
tamerimia.ug
netwire2021.duckdns.org
popupcalls.ddns.net
harold.ns01.info
neease.net
haija.mine.nu
alice2019.myftp.biz
86t7b9br9.ddns.net
stylaksiarra.ddns.net
futerty.mooo.com
tartful.hopto.org
fartgul.duckdns.org
fratful.dynu.net
dunlop.hopto.org
Last Seen at

Recent blog posts

post image
Private AI Assistant for Malware Analysis in...
watchers 934
comments 0
post image
5 Characteristics of Good Threat Intelligence...
watchers 477
comments 0
post image
New PhantomLoader Malware Distributes SSLoad:...
watchers 4064
comments 0

What is Netwire RAT?

Netwire is a remote access trojan-type malware. A RAT is malware used to control an infected machine remotely. This particular RAT can perform over 100 malicious actions on infected machines and can attack multiple systems, including Windows, Apple’s MacOS, and Linux.

Netwire malware is available for purchase on the darknet in the underground hacking communities, where attackers can buy this RAT for the price of 40 to 140 USD. In addition, Netwire can be purchased on the surface internet for a price of 180 USD. Notably, in 2016 Netwire received an update that added the functionality to steal data from devices connected to the infected machine, such as USB credit card readers, allowing Netwire to perform POS attacks.

General description of Netwire RAT

Netwire Trojan core functionality allows this malware to take remote control of infected PCs, record keyboard strokes and mouse behavior, take screenshots, check system information, and create fake HTTP proxies.

The keylogger functionally allows Netwire to record various personal data imputed on a computer connected to the internet or a corporate network. Combined with the ability to steal credit card information and operate undetected for extended periods of time, Netwire RAT is truly capable of inflicting serious dangers to organizations.

In some malicious campaigns, the Netwire trojan was used to target healthcare and banking businesses. The malware was also documented as being used by a group of scammers from Africa who utilized Netwire to take remote control of infected machines.

Netwire RAT creators have put in a lot of work to ensure that researchers have a hard time analyzing this malware, as many precautions are taken to complicate the research process, including techniques like multiple data encryption layers and string obfuscation. In addition, the malware uses a custom C2 binary protocol that is also encrypted, and so is the relevant data before transmission.

During one campaign, researchers have observed Netwire being distributed as “TeamViewer 10” – named so in an effort to trick victims into thinking that they have downloaded the legitimate remote assistance software. Once the execution process began, this version would drop an .EXE file and start establishing persistence right away. The malware created a Windows shortcut in the Startup menu to ensure that the Netwire trojan would always run when the user logged into the system. Interestingly, another trick designed to keep the malware hidden actually gave it away during this particular campaign. The malware would inject its code into the Notepad.exe, unveiling its presence since it’s not normal for the notepad to have an always active network connection. Only after decoding the data prepared for transmission to the C2, the sensitive nature of the stolen information was discovered. Unfortunately, researches did not reveal what the organization was targeted in this particular attack.

Netwire RAT malware analysis

A video simulation recorded on ANY.RUN enables researchers to study the lifecycle of the Netwire in a lot of detail and works like a tutorial.

process graph of the Netwire execution Figure 1: Process graph generated by ANY.RUN allows visualizing the life cycle of Netwire

a text report of a netwire analysis Figure 2: A text report generated by ANY.RUN is a great tool to share the research results

Netwire RAT execution process

Netwire isn't as exciting as some other malicious programs can be as far as malware execution goes. It makes its way into the device, mostly in the form of a payload.

The user receives a spam email with an attached Microsoft Word file. After the user downloads and opens this file, the executable is dropped or downloaded onto the machine. After that, the executable starts performing the main malicious activity such as writing itself in autorun, connecting to C2 servers, and stealing information from an infected device. Netwire also has the ability to inject into unsuspicious processes from which it can perform malicious activities.

Distribution of Netwire RAT

Netwire RAT is usually being distributed in email phishing campaigns in the form of a malicious Microsoft Office document. The victim must enable macros for the RAT to enter an active state. The macros then proceed to download Netwire, allowing the malware to start the execution process.

How to export Netwire data using ANY.RUN?

If analysts want to do additional work with events from tasks or share them with colleagues for tutorials, they can export to different formats. Just click on the "Export" button and choose the most suitable format in the drop-down menu. Export of any kind of malware research is available including Predator the Thief or Qbot.

Export options for netwire malware Figure 3: Export options for netwire malware

Conclusion

Diverse information stealing feature sets combined with the ability to target multiple operating systems and steal data from credit cards used in an infected system make Netwire Trojan a highly dangerous remote access trojan.

Despite its impressive functionality, the malware is fairly accessible, “retailing” on underground forums for as little as 40 dollars in some select cases. The situation is further worsened by the fact that creators of Netwire RAT have implemented several features designed to complicate the analysis as much as possible.

However, researchers can take advantage of interactive malware hunting services, such as ANY.RUN, which allows to influence the simulation at any point and get much purer research results.

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Amadey screenshot
Amadey
amadey
Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.
Read More
Arkei screenshot
Arkei
arkei stealer
Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.
Read More
AsyncRAT screenshot
AsyncRAT
asyncrat
AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.
Read More
WarZone screenshot
WarZone
warzone avemaria stealer trojan rat
WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.
Read More