NETWIRE

Malware & Tools · NETWIRE

· MalwareS0198 · Zararlı Yazılım

Type

malware

Techniques

Used By

4 groups

Platforms

Windows, Linux, macOS

Description

NETWIRE is a publicly available, multiplatform remote administration tool (RAT) that has been used by criminal and APT groups since at least 2012.(Citation: FireEye APT33 Sept 2017)(Citation: McAfee Netwire Mar 2015)(Citation: FireEye APT33 Webinar Sept 2017)

Tactic Coverage

execution (9)stealth (8)privilege escalation (8)persistence (7)command and control (7)discovery (6)collection (6)credential access (3)initial access (2)defense impairment (1)

Used By (4 groups)

G0064APT33HOLMIUM, Elfin G0083SilverTerrier G1018TA2541 G0089The White Company

Techniques (45)

T1010Application Window Discovery

discovery

T1016System Network Configuration Discovery

discovery

T1027Obfuscated Files or Information

stealth

T1027.002Software Packing

stealth

T1027.011Fileless Storage

stealth

T1036.001Invalid Code Signature

stealth

T1036.005Match Legitimate Resource Name or Location

References

https://attack.mitre.org/software/S0198 https://www.brighttalk.com/webcast/10703/275683 https://securingtomorrow.mcafee.com/mcafee-labs/netwire-rat-behind-recent-targeted-attacks/https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html