MITRE ATT&CKsoftware (malware)
S0198 NETWIRE
- Domain
- enterprise
- Platforms
- Windows, Linux, macOS
- Version
- 1.6
- Created
- 2018-04-18
Description
NETWIRE is a publicly available, multiplatform remote administration tool (RAT) that has been used by criminal and APT groups since at least 2012.
Related
Uses · MITRE ATT&CK (45)
- T1027.011 Fileless Storage sub-technique
- T1547.015 Login Items sub-technique
- T1573 Encrypted Channel technique
- T1573.001 Symmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1074.001 Local Data Staging sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.004 Unix Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1564.001 Hidden Files and Directories sub-technique
- T1560 Archive Collected Data technique
- T1560.003 Archive via Custom Method sub-technique
- T1555.003 Credentials from Web Browsers sub-technique
- T1056.001 Keylogging sub-technique
- T1555 Credentials from Password Stores technique
- T1036.001 Invalid Code Signature sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1027.002 Software Packing sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1543.001 Launch Agent sub-technique
- T1055.012 Process Hollowing sub-technique
- T1053.003 Cron sub-technique
- T1053.005 Scheduled Task sub-technique
- T1547.013 XDG Autostart Entries sub-technique
- T1010 Application Window Discovery technique
References
- https://www.brighttalk.com/webcast/10703/275683 FireEye APT33 Webinar Sept 2017
- https://securingtomorrow.mcafee.com/mcafee-labs/netwire-rat-behind-recent-targeted-attacks/ McAfee Netwire Mar 2015
- https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html FireEye APT33 Sept 2017