Skip to content
MalwareWiki

Malware

NetWire RC

aka NetWeird · NetWire · Recam

Netwire is a RAT, its functionality seems focused on password stealing and keylogging, but includes remote control capabilities as well.

NetWire RC, also known as NetWeird, NetWire, Recam, is a Windows malware family operated by APT33.

Background

Netwire is a RAT whose feature set appears centered on credential theft and keylogging, while also providing remote control of the host.

On an infected machine, keylog files are kept in an obfuscated form, produced by the following algorithm:

        for i in range(0,num_read):
            buffer[i] = ((buffer[i]-0x24)^0x9D)&0xFF

Source: Malpedia (Fraunhofer FKIE).