Red Canary NETWIRE January 2020

NETWIRE can discover and close windows on controlled systems.

NETWIRE can collect the IP address of a compromised host.

NETWIRE has used .NET packer tools to evade detection.

NETWIRE can store its configuration information in the Registry under `HKCU:\Software\Netwire`.

NETWIRE has masqueraded as legitimate software including TeamViewer and macOS Finder.

NETWIRE can use crontabs to establish persistence.

NETWIRE can inject code into system processes including notepad.exe, svchost.exe, and vbc.exe.

The NETWIRE payload has been injected into benign Microsoft executables via process hollowing.

NETWIRE can perform keylogging.

NETWIRE can issue commands using cmd.exe.

NETWIRE has the ability to use /bin/bash and /bin/sh to execute commands.

NETWIRE has the ability to communicate over HTTP.

NETWIRE can implement use of proxies to pivot traffic.

NETWIRE can use TCP in C2 communications.

NETWIRE can modify the Registry to store its configuration information.

NETWIRE can capture the victim's screen.

NETWIRE can automatically archive collected data.

NETWIRE can use launch agents for persistence.

NETWIRE creates a Registry start-up entry to establish persistence.

NETWIRE can use XDG Autostart Entries to establish persistence on Linux systems.

NETWIRE can persist via startup options for Login items.

NETWIRE can retrieve passwords from messaging and mail client applications.

NETWIRE has the ability to steal credentials from web browsers including Internet Explorer, Opera, Yandex, and Chrome.

NETWIRE has the ability to compress archived screenshots.

NETWIRE can copy itself to and launch itself from hidden folders.

NETWIRE can encrypt C2 communications.

NETWIRE can use AES encryption for C2 data transferred.