TF-MAL-osx.netwire

Description

ThreatFox malware family `osx.netwire`. Printable name: NetWire.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• Netwire RAT Malware Analysis, Overview by ANY.RUN
  web:any.run

  Netwire is a remote access trojan type malware . A RAT is malware used to control an infected machine remotely. Follow live malware statistics of this trojan and get new reports, samples, IOCs, etc.

  2026-05-22 05:29 UTC
• NETWIRE, Software S0198 | MITRE ATT&CK®
  web:attack.mitre.org

  Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware . Retrieved February 15, 2018. McAfee. (2015, March 2). Netwire RAT Behind Recent Targeted Attacks. Retrieved February 15, 2018. Davis, S. and Carr, N. (2017, September 21). APT33: New Insights into Iranian Cyber Espionage Group.

  2026-05-22 05:29 UTC
• NETWire - Cybersight Malware Samples
  web:cybersight-security.github.io

  NETWire is a remote access trojan (RAT) designed to provide cybercriminals with unauthorized access and control over infected systems. It is a versatile malware tool commonly used in cyber attacks to steal sensitive information, monitor user activity, and execute malicious commands remotely.

  2026-05-22 05:29 UTC
• NetWire RC (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  Netwire is a RAT, its functionality seems focused on password stealing and keylogging, but includes remote control capabilities as well. Keylog files are stored on the infected machine in an obfuscated form.

  2026-05-22 05:29 UTC
• How the FBI proved a remote admin tool was actually malware
  web:techcrunch.com

  While NetWire was also reportedly advertised on hacking forums, the malware owners marketed it on a website that made it look like it was a legitimate remote administration tool.

  2026-05-22 05:29 UTC
• ThreatFox | NetWire RC
  web:threatfox.abuse.ch

  ThreatFox Database Indicators of Compromise (IOCs) on ThreatFox are associated with a certain malware fas. A malware sample can be associated with only one malware family . The page below gives you an overview on indicators of compromise associated with win. netwire . You can also get this data through the ThreatFox API. Database Entry

  2026-05-22 05:29 UTC
• CIRCL » TR-23 Analysis - NetWiredRC malware
  web:www.circl.lu

  TR-23 Analysis - NetWiredRC malware Overview CIRCL analyzed a malware sample which was only sporadically detected by just a handful antivirus engines, based on heuristic detection. CIRCL analyzed the entire command structure of the malware and was able to attribute this specific malware to the malware NetWiredRC.

  2026-05-22 05:29 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  2026-05-22 05:29 UTC
• Exploring the REF2731 Intrusion Set — Elastic Security Labs
  web:www.elastic.co

  The Elastic Security Labs team has been tracking REF2731, an 5-stage intrusion set involving the PARALLAX loader and the NETWIRE RAT.

  2026-05-22 05:29 UTC
• NetWire malware: What it is, how it works and how to prevent it ...
  web:www.infosecinstitute.com

  Uncover the secrets of NetWire malware , a Trojan focused on password theft, keylogging, and remote control. Learn how to prevent it today!

  2026-05-22 05:29 UTC

Only Available for Registered Users. Sign in to view.