Essential information

Value / Name

0c88aefaf375dd21e89f9089cda164c321e412b1

Confidence

100/100

Revoked

Yes

Valid from

03/02/2023 20:55

Valid until

08/05/2024 21:55

Pattern type

yara

Published

20/12/2025 19:37

Modified

20/12/2025 23:31

Author / Source

AlienVault

Description

No description.

Pattern

rule Windows_Trojan_Netwire_4 {   
      meta:   
          author = "Elastic Security"   
          os = "Windows"   
          arch = "x86"   
          category_type = "Trojan"   
          family = "Netwire"   
          threat_name = "Windows.Trojan.Netwire"   
      strings:   
          $a1 = "http://%s%ComSpec" ascii fullword   
          $a2 = "%c%.8x%s" ascii fullword   
          $a3 = "%6\\6Z65dlNh\\YlS.dfd" ascii fullword   
          $a4 = "GET %s HTTP/1.1" ascii fullword   
          $a5 = "R-W65: %6:%S" ascii fullword   
          $a6 = "PTLLjPq %6:%S -qq9/G.y" ascii fullword   
      condition:   
          4 of them   
   }

Labels / Tags

Labels: keylogger mutex netwire pe file rat registry manipulation

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.