NetWire RC
Aliases: NetWeird, NetWire, Recam
- First seen
- 2012-08-01 00:00:00
- Malware type
- rat, credential-stealer, keylogger
- Family
- Malware family
- Related IoCs
- 136 (114 malicious)
- Last IoC activity
- 2026-10-18 03:20:57
- Profile updated
- 2026-07-07 12:42:27
Targeted industries: financial-services technology-and-telecommunications government-and-public-sector
Context
Netwire is a RAT, its functionality seems focused on password stealing and keylogging, but includes remote control capabilities as well. Keylog files are stored on the infected machine in an obfuscated form. The algorithm is: for i in range(0,num_read): buffer[i] = ((buffer[i]-0x24)^0x9D)&0xFF
Detection coverage
- 2 YARA rules
Detection rules
- MALPEDIA_Win_Netwire_Auto (yara-rule)
- DITEKSHEN_MALWARE_Win_Netwire (yara-rule)
Reports & references
- Mandiant — Apt33 Insights Into Iranian Cyber Espionage (report)
- Broadcom/Symantec — Elfin Apt33 Espionage (report)
- secureworks.com — Cobalt Trinity (report)
- sentinelone.com — Modifiedelephant Apt And A Decade Of Fabricating Evidence (report)
- news.sophos.com — Raticate Rats As Service With Commercial Crypter (report)
- info.spamhaus.com — 2022%20Q3%20Botnet%20Threat%20Update (report)
- Broadcom/Symantec — Bluebottle Banks Targeted Africa (report)
- Mandiant — Cds19 Executive S08 Achievement Unlocked (report)
- Cisco Talos — A Year Of Fajan Evolution And Bloomberg (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Netwire (report)
- drive.google.com — View (report)
- theregister.com — Fbi Netwire Seizure (report)
- blog.vincss.net — Re011 Unpack Crypter Cua Malware Netwire Bang X64Dbg (report)
- Cisco Talos — Recam Redux Deconfusing Confuserex (report)
- mp.weixin.qq.com — Yrdzybpvtbu 9Srzplsnka (report)
- lmntrix.com — Analysis Of Netwire Rat (report)
- context-cdn.washingtonpost.com — B463D38B 2384 4Bb0 A94B B1B17223Ffd0. (report)
- drive.google.com — View (report)
- maskop9.wordpress.com — Analysis Of Netwiredrc Trojan (report)
- blogs.vmware.com — Active C2 Discovery Using Protocol Emulation Part1 Hydseven Netwire (report)
- decoded.avast.io — The Tangle Of Wiryjmpers Obfuscation (report)
- youtube.com — Watch (report)
- blogs.blackberry.com — Threat Thursday Netwire Rat Is Coming Down The Line (report)
- zscaler.com — Look Hydrojiin Campaign (report)
- cybereason.com — Cybereason Exposes Malware Targeting Us Taxpayers (report)