S0198 - Netwire

Name: S0198 - Netwire
Creator: Maltiverse
Published: 2023-06-14

NETWIRE is a publicly available, multiplatform remote administration tool (RAT) that has been used by criminal and APT groups since at least 2012.

Author: agomez
Created: 2023-06-14 00:04:56
Last updated: 2026-02-07 19:05:49
Downloads: 292950
Sample indicators: 5405

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

e6ac25f9a9cb0129b3ca2ca7975d92be465ceb493b0aafeda13b318d63a21ebe Sample

modified 2026-10-18 06:16:07
NetWire (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

d323d737c4470359f2f78d77a804a9f2ad68cc61756c7eac92b712484445d98f Sample

modified 2026-10-18 06:05:17
NetWire (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

2026-10-18_f6ad97fe92ab9386c74cf798cedfc065_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-18 05:49:00
Netwire (Triage)

2026-10-18_f700b4d9f930a215f70db83cac47e8b0_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-18 05:47:13
Netwire (Triage)

2026-10-18_f9dfedc7e349eb770fa0f98a647f8652_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-18 05:36:54
Netwire (Triage)

2026-10-18_fd58fd3c99e74e51fa92481ea336a2e6_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-18 05:26:06
Netwire (Triage)

2026-06-12_e714e8a3e42c2d15b732691f56be16a3_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-18 05:23:20
Netwire (Triage)

2026-10-17_d2c77e2a70ce9ebbbd56a13e27c28533_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-18 05:05:33
Netwire (Triage)

2026-10-17_d56951a0662669623fe956a4f72468cd_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-18 04:51:54
Netwire (Triage)

2026-10-17_d70b84cdce977d12fa8d4390c16a19b5_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-18 04:42:02
Netwire (Triage)

2026-10-17_dad149b95de28dea66015b270045f11a_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-18 04:19:00
Netwire (Triage)

2026-10-17_dfdfd413aecbc861b675cdc3aaed57ab_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-18 03:48:03
Netwire (Triage)

2026-10-17_e35b5137844ef1aac1a2fbab322b2548_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-18 03:20:24
Netwire (Triage)

48fd8be5d040b37dd1df8d2af2798effc65bedab337f44ddabc6e1e8b3b9def8 Sample

modified 2026-10-18 03:13:59
NetWire (Cyber Threat Alliance)

2026-10-17_e7e01f89c8c57f0b381fc19473a47d49_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-18 02:47:48
Netwire (Triage)

2026-10-17_ec03dba20cbbd6087c459bca25ee458a_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-18 02:23:34
Netwire (Triage)

2026-10-17_f1ca61126ad812800e6368e1beb907a9_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-18 01:38:03
Netwire (Triage)

socratecafu18.zapto.org Hostname

modified 2026-10-18 00:40:09
Malware site (Hybrid-Analysis) · Generic.Malware (Hybrid-Analysis) · NetWire RC (ThreatFox Abuse.ch)

tmpm_fznyum Sample

modified 2026-10-18 00:08:16
Netwire (Triage)

593d3ef9cf64863f2ba7d27c4158f41818ec93bb1c5bcf972ba71856cdc7fc69 Sample

modified 2026-10-17 23:12:51
NetWire (Cyber Threat Alliance)

b047b43d2399350b20bd6091ff65c72045889ba8dea44bca2294b37245d2a87f Sample

modified 2026-10-17 23:10:50
NetWire (Cyber Threat Alliance)

2026-10-16_19135e7460b1f3e3a4c0a3e739cca411_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 22:50:59
Netwire (Triage)

3f12155ee7ca70aee24bded3981d4476ba875d8c64c7a12f3f02754d550fc5bc Sample

modified 2026-10-17 22:04:50
NetWire (Cyber Threat Alliance)

5cbd8759fa5418b197faf858b881c72b8223a2ea0b44d4ffaf004b1ace66b846 Sample

modified 2026-10-17 21:51:40
NetWire (Cyber Threat Alliance)

2c2014a40b36b8d913b713441d72dbffa30ecdc66238faab318f9e1f77bcced3 Sample

modified 2026-10-17 21:49:49
NetWire (Cyber Threat Alliance)

2026-10-16_2f45c4134e8b4650a035865e131fc038_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 20:45:20
Netwire (Triage)

c066f1d3f7237bd3f779379401181d0482fa7edb5b1edd91f9d5e751c06c6682 Sample

modified 2026-10-17 20:39:50
NetWire (Cyber Threat Alliance)

2026-10-16_40e49a8bff4e20a399a62ddf59c3a17a_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 19:10:21
Netwire (Triage)

2026-10-16_43bf706cb6dd5e11894c0f24c5f6344c_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 18:52:07
Netwire (Triage)

2026-10-16_43c8b5c20320926dc6d7ddde1e3635a5_agent-tesla_elex_maze_netwire_remcos_xloader Sample

modified 2026-10-17 18:51:56
Netwire (Triage)

2026-10-16_50044530539a4b256d2d5ee2ca227e2b_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 17:41:30
Netwire (Triage)

6bca4e060623f6e6d6943f2fdd50be56518ccf13cf99067295517ba47ccf4ec7 Sample

modified 2026-10-17 17:25:38
NetWire (Cyber Threat Alliance)

sftp21.duckdns.org Hostname

modified 2026-10-17 16:42:34
NetWire RC (ThreatFox Abuse.ch)

modified 2026-10-17 16:41:58
Nanocore RAT (ThreatFox Abuse.ch) · Trojan.VBS.DUNIHI (Hybrid-Analysis) · Trojan.Generic (Hybrid-Analysis) · Trojan.NetWire (Hybrid-Analysis) · Malware site (Hybrid-Analysis)

myonlinehost.ddns.net Hostname

modified 2026-10-17 16:39:30
NetWire RC (ThreatFox Abuse.ch)

sepp101.chickenkiller.com Hostname

modified 2026-10-17 16:35:27
NetWire RC (ThreatFox Abuse.ch)

equipepro1.duckdns.org Hostname

modified 2026-10-17 16:34:49
NetWire RC (ThreatFox Abuse.ch)

2026-10-16_5d4c06fa2378823560d609e00d4a7b39_agent-tesla_elex_maze_netwire_remcos_xloader Sample

modified 2026-10-17 16:31:38
Netwire (Triage)

2026-10-16_68046f6632860f0147fe9029b4cae9fe_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 15:40:30
Netwire (Triage)

2026-10-16_6a73e4ec9c2d9829853f4b9014aece09_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 15:24:50
Netwire (Triage)

2026-10-16_77cd5c7e7c3e70ef2491b0debb7dffd9_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 14:16:18
Netwire (Triage)

2026-10-16_83229d502e30e88df7f78f7a4fcec3a2_agent-tesla_elex_maze_netwire_remcos_xloader Sample

modified 2026-10-17 13:15:55
Netwire (Triage)

2026-10-16_9cfbd50b41e1bc1f4a111889416379b4_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 10:56:41
Netwire (Triage)

2026-10-16_a0a5bb2df6b7b08b41d14fa772f2fc21_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 10:37:04
Netwire (Triage)

2026-10-16_a8ead501175c9dacad3508737c1aa42f_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 09:50:19
Netwire (Triage)

2026-10-16_a95be553b32ba0297b055f140e59e1eb_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 09:46:35
Netwire (Triage)

e4294de8721e44526a0ab0ae98390acc6dc29f3ca0defc3861373e501f7e9c11 Sample

modified 2026-10-17 09:15:40
NetWire (Cyber Threat Alliance)

2026-10-16_b0124056c5d63c8754ab7c5a68b5744c_agent-tesla_elex_maze_netwire_remcos_xloader Sample

modified 2026-10-17 09:09:09
Netwire (Triage)

2026-10-16_b0bdaf998c09f616f460c69c591bb7de_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 09:03:34
Netwire (Triage)

2026-10-16_b489afb6e3e0a8711eaee959531e7282_agent-tesla_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 08:44:30
Netwire (Triage)

javaupdate.100chickens.biz Hostname

modified 2026-10-17 08:40:33
NetWire RC (ThreatFox Abuse.ch)

2026-10-16_b5a7b961aa119c66f5028ca773d65133_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 08:38:23
Netwire (Triage)

qayshaija.ddns.net Hostname

modified 2026-10-17 08:37:46
NetWire RC (ThreatFox Abuse.ch)

2026-10-16_c0589d885fc1c2e1cae66b55d3ed31aa_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 07:45:43
Netwire (Triage)

01f08ee63dd5a5ed9975759632c214da16a70f960d4e0530d8a12252eb096263 Sample

modified 2026-10-17 07:21:34
NetWire (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

4cc934f43bb76913f83aa9ddfd415937c1beb29850aa5a3fb2f206355214dda8 Sample

modified 2026-10-17 07:18:21
NetWire (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

2026-10-16_c5c088678dcfa0c5eaa95d55f5f5cdf9_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 07:18:03
Netwire (Triage)

3034d9e04b71f4560aa5d1d77845006cbaf4755e5f4475bc822f161b32331d7f Sample

modified 2026-10-17 07:07:51
NetWire (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

2026-10-16_d10f8dff656c81290c6c3f4d04860d23_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 06:18:14
Netwire (Triage)

2026-10-16_d20bb3c509c8088a020c344d614bf314_agent-tesla_elex_maze_netwire_remcos_xloader Sample

modified 2026-10-17 06:11:39
Netwire (Triage)

b0576663c39deb66fcbd120633f334f19973b4f1de747b92455534cc52af53ec Sample

modified 2026-10-17 06:02:49
NetWire (Cyber Threat Alliance)

2026-10-16_d4fc3a5e0412dc7d67b36487f239776c_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 05:57:31
Netwire (Triage)

6d2e3a63e1e1721caa2895402d61e47268845cd68b1c569ec1ce321fca0bc6b9 Sample

modified 2026-10-17 05:52:38
NetWire (Cyber Threat Alliance)

2026-10-16_dcea283cf16d8150af516cdf1ee11013_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 05:14:10
Netwire (Triage)

starlucky.warzonedns.com Hostname

modified 2026-10-17 04:40:16
Nanocore RAT (ThreatFox Abuse.ch) · Backdoor.MSIL.Agent (Hybrid-Analysis) · HEUR:Trojan.MSIL.NetWire (Hybrid-Analysis)

wcbradley.duckdns.org Hostname

modified 2026-10-17 04:36:40
Nanocore RAT (ThreatFox Abuse.ch) · Malicious site (Hybrid-Analysis) · Trojan.Generic (Hybrid-Analysis) · Trojan.NetWire (Hybrid-Analysis) · Kryptik.UWC (Hybrid-Analysis)

2026-10-16_e45be531955d5b4906d2cca7d978b665_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 04:29:44
Netwire (Triage)

d5ddf32e510d507ffb953fcb858a6f5aa3ebecb484dbcd438e56e295986565ba Sample

modified 2026-10-17 03:13:38
NetWire (Cyber Threat Alliance)

Nizi International S.A. #New Order.exe Sample

modified 2026-10-17 02:46:22
NetWire (Abuse.ch)

2b3dac325c56e66440fa2588d941a3bcd38e9089608bcb2399ff34c4004f3e49 Sample

modified 2026-10-17 02:33:48
NetWire (Cyber Threat Alliance)

42f3b05b2552895dd418a87b192326302e00ca94583cd64ff25893e31dac8266 Sample

modified 2026-10-17 02:31:38
NetWire (Cyber Threat Alliance)

cd8a1a2cf4c6ad19b5486514ed1295293b73e5050961663c6725f37070e54c09 Sample

modified 2026-10-17 02:29:38
NetWire (Cyber Threat Alliance)

2026-10-16_fbf9d079694b97f24b0f5f9fa9e2c886_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 01:34:11
Netwire (Triage)

2026-10-16_fc375a66815c90e2f154e96a4da07d19_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-17 01:33:07
Netwire (Triage)

15bb5120706d663d99d9dd9e21d642d65dca1fee95d88ee14df724d5e8fd1c58 Sample

modified 2026-10-17 01:12:40
NetWire (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

info1.duckdns.org Hostname

modified 2026-10-17 00:40:12
Kryptik.OUA (Hybrid-Analysis) · Kryptik.QHB (Hybrid-Analysis) · Generic.Malware (Hybrid-Analysis) · Trojan.Generic (Hybrid-Analysis) · TOP AMENAZAS - 19022020 (CronUp Threat Intel)