FireEye NETWIRE March 2019

NETWIRE has used a custom obfuscation algorithm to hide strings including Registry keys, APIs, and DLL names.

NETWIRE can capture session logon details from a compromised host.

NETWIRE can create a scheduled task to establish persistence.

The NETWIRE payload has been injected into benign Microsoft executables via process hollowing.

NETWIRE can perform keylogging.

NETWIRE can discover processes on compromised hosts.

The NETWIRE binary has been executed via PowerShell script.

NETWIRE has been executed through use of VBScripts.

NETWIRE has the ability to write collected data to a file created in the ./LOGS directory.

NETWIRE has used web services including Paste.ee to host payloads.

NETWIRE can downloaded payloads from C2 to the compromised host.

NETWIRE can use Native API including CreateProcess GetProcessById, and WriteProcessMemory.

NETWIRE can capture the victim's screen.

NETWIRE has been executed through convincing victims into clicking malicious links.

TA2541 has used malicious links to cloud and web services to gain execution on victim machines.

NETWIRE has been executed through luring victims into opening malicious documents.

NETWIRE has the ability to steal credentials from web browsers including Internet Explorer, Opera, Yandex, and Chrome.

NETWIRE has used a custom encryption algorithm to encrypt collected data.