As cited
Copy frozen at (site build).
threat intel
NETWIRE Dynamic Configuration Extraction
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
NETWIRE Dynamic Configuration Extraction
Elastic Security Labs released a configuration extractor tool for NETWIRE, a remote access tool (RAT) used since at least 2014 that has seen increased prevalence in the second half of 2022. The extractor uses YARA rules and Capstone disassembly to recover RC4-encrypted configuration data from NETWIRE binaries and memory dumps, extracting command and control (C2) servers, persistence mechanisms, keylogger paths, and other operational indicators. The research includes detection YARA rules and a list of 50+ C2 indicators for threat hunting.
Why it matters: Defenders tracking or responding to NETWIRE infections can use this freely available extractor to extract atomic indicators of compromise (indicator of compromise (IOC)) from samples, accelerating detection tuning, threat enrichment, and remediation timelines.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
NETWIRE Dynamic Configuration Extraction
Elastic Security Labs released a configuration extractor tool for NETWIRE, a remote access tool (RAT) used since at least 2014 that has seen increased prevalence in the second half of 2022. The extractor uses YARA rules and Capstone disassembly to recover RC4-encrypted configuration data from NETWIRE binaries and memory dumps, extracting command and control (C2) servers, persistence mechanisms, keylogger paths, and other operational indicators. The research includes detection YARA rules and a list of 50+ C2 indicators for threat hunting.
Why it matters: Defenders tracking or responding to NETWIRE infections can use this freely available extractor to extract atomic indicators of compromise (indicator of compromise (IOC)) from samples, accelerating detection tuning, threat enrichment, and remediation timelines.
- Source published
- First seen by Cybersecurity Tracker