NETWIRE Dynamic Configuration Extraction
ID: 0c661d2e-17a9-5d1b-b210-eace421059a6
STIX ID: report--0c661d2e-17a9-5d1b-b210-eace421059a6
Feed Name: Elastic Security Labs
Threat Score
Elastic Security Labs documents an uptick in NETWIRE RAT activity and describes a new RC4-configuration extractor that recovers encrypted configuration values from binaries and memory dumps; the report includes usage instructions, YARA detection rules, and a substantial list of C2 IPs and domains to aid detection, hunting, and incident response.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.