H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

NETWIRE

[NETWIRE](https://attack.mitre.org/software/S0198) is a publicly available, multiplatform remote administration tool (RAT) that has been used by criminal and APT groups since at least 2012.(Citation: FireEye APT33 Sept 2017)(Citation: McAfee Netwire Mar 2015)(Citation: FireEye APT33 Webinar Sept 2017)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[NETWIRE](https://attack.mitre.org/software/S0198) is a publicly available, multiplatform remote administration tool (RAT) that has been used by criminal and APT groups since at least 2012.(Citation: FireEye APT33 Sept 2017)(Citation: McAfee Netwire Mar 2015)(Citation: FireEye APT33 Webinar Sept 2017)

Labels

malware
49 recorded

Relationships

uses
from APT33
Group
uses
to Application Window Discovery
Technique
uses
to Archive Collected Data
Technique
uses
to Archive via Custom Method
Technique
uses
to Automated Collection
Technique
uses
to Credentials from Password Stores
Technique
uses
to Credentials from Web Browsers
Technique
uses
to Cron
Technique
uses
to Encrypted Channel
Technique
uses
to File and Directory Discovery
Technique
uses
to Fileless Storage
Technique
uses
to Hidden Files and Directories
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Invalid Code Signature
Technique
uses
to Keylogging
Technique
uses
to Launch Agent
Technique
uses
to Local Data Staging
Technique
uses
to Login Items
Technique
uses
to Malicious File
Technique
uses
to Malicious Link
Technique
uses
to Match Legitimate Resource Name or Location
Technique
uses
to Modify Registry
Technique
uses
to Native API
Technique
uses
to Non-Application Layer Protocol
Technique
uses
to Obfuscated Files or Information
Technique
uses
to PowerShell
Technique
uses
to Process Discovery
Technique
uses
to Process Hollowing
Technique
uses
to Process Injection
Technique
uses
to Proxy
Technique
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Scheduled Task
Technique
uses
to Screen Capture
Technique
uses
to Software Packing
Technique
uses
to Spearphishing Attachment
Technique
uses
to Spearphishing Link
Technique
uses
to Symmetric Cryptography
Technique
uses
to System Information Discovery
Technique
uses
to System Network Configuration Discovery
Technique
uses
to System Network Connections Discovery
Technique
uses
to Unix Shell
Technique
uses
to Visual Basic
Technique
uses
to Web Protocols
Technique
uses
to Web Service
Technique
uses
to Windows Command Shell
Technique
uses
to XDG Autostart Entries
Technique
uses
from SilverTerrier
Group
uses
from TA2541
Group
uses
from The White Company
Group
5 external

References

mitre-attack
S0198
open
NETWIRE
—
FireEye APT33 Webinar Sept 2017
https://www.brighttalk.com/webcast/10703/275683
open
McAfee Netwire Mar 2015
https://securingtomorrow.mcafee.com/mcafee-labs/netwire-rat-behind-recent-targeted-attacks/
open
FireEye APT33 Sept 2017
https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance