ATT&CK ReferencesMcAfee Netwire Mar 2015

McAfee Netwire Mar 2015

McAfee. (2015, March 2). Netwire RAT Behind Recent Targeted Attacks. Retrieved February 15, 2018.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1036.001 Invalid Code Signature	MalwareNETWIRE	The NETWIRE client has been signed by fake and invalid digital certificates. McAfee Netwire Mar 2015
T1056.001 Keylogging	MalwareNETWIRE	NETWIRE can perform keylogging. FireEye APT33 Webinar Sept 2017 FireEye NETWIRE March 2019 McAfee Netwire Mar 2015 Proofpoint NETWIRE December 2020 Red Canary NETWIRE January 2020
T1082 System Information Discovery	MalwareNETWIRE	NETWIRE can discover and collect victim system information. McAfee Netwire Mar 2015
T1113 Screen Capture	MalwareNETWIRE	NETWIRE can capture the victim's screen. FireEye NETWIRE March 2019 McAfee Netwire Mar 2015 Proofpoint NETWIRE December 2020 Red Canary NETWIRE January 2020
T1547.001 Registry Run Keys / Startup Folder	MalwareNETWIRE	NETWIRE creates a Registry start-up entry to establish persistence. McAfee Netwire Mar 2015 Proofpoint NETWIRE December 2020 Red Canary NETWIRE January 2020 Unit 42 NETWIRE April 2020

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.