Procedure examples

NETWIRE can discover and close windows on controlled systems.

NETWIRE can collect the IP address of a compromised host.

NETWIRE has used a custom obfuscation algorithm to hide strings including Registry keys, APIs, and DLL names.

NETWIRE has used .NET packer tools to evade detection.

NETWIRE can store its configuration information in the Registry under `HKCU:\Software\Netwire`.

The NETWIRE client has been signed by fake and invalid digital certificates.

NETWIRE has masqueraded as legitimate software including TeamViewer and macOS Finder.

NETWIRE can capture session logon details from a compromised host.

NETWIRE can use crontabs to establish persistence.

NETWIRE can create a scheduled task to establish persistence.

NETWIRE can inject code into system processes including notepad.exe, svchost.exe, and vbc.exe.

The NETWIRE payload has been injected into benign Microsoft executables via process hollowing.

NETWIRE can perform keylogging.

NETWIRE can discover processes on compromised hosts.

The NETWIRE binary has been executed via PowerShell script.

NETWIRE can issue commands using cmd.exe.

NETWIRE has the ability to use /bin/bash and /bin/sh to execute commands.

NETWIRE has been executed through use of VBScripts.

NETWIRE has the ability to communicate over HTTP.

NETWIRE has the ability to write collected data to a file created in the ./LOGS directory.

NETWIRE can discover and collect victim system information.

NETWIRE has the ability to search for files on the compromised host.

NETWIRE can implement use of proxies to pivot traffic.

NETWIRE can use TCP in C2 communications.

NETWIRE has used web services including Paste.ee to host payloads.

NETWIRE can downloaded payloads from C2 to the compromised host.

NETWIRE can use Native API including CreateProcess GetProcessById, and WriteProcessMemory.

NETWIRE can modify the Registry to store its configuration information.

NETWIRE can capture the victim's screen.

NETWIRE can automatically archive collected data.

NETWIRE has been executed through convincing victims into clicking malicious links.

NETWIRE has been executed through luring victims into opening malicious documents.

NETWIRE can use launch agents for persistence.

NETWIRE creates a Registry start-up entry to establish persistence.

NETWIRE can use XDG Autostart Entries to establish persistence on Linux systems.

NETWIRE can persist via startup options for Login items.

NETWIRE can retrieve passwords from messaging and mail client applications.

NETWIRE has the ability to steal credentials from web browsers including Internet Explorer, Opera, Yandex, and Chrome.

NETWIRE has the ability to compress archived screenshots.

NETWIRE has used a custom encryption algorithm to encrypt collected data.

NETWIRE can copy itself to and launch itself from hidden folders.

NETWIRE has been spread via e-mail campaigns utilizing malicious attachments.

NETWIRE has been spread via e-mail campaigns utilizing malicious links.

NETWIRE can encrypt C2 communications.

NETWIRE can use AES encryption for C2 data transferred.