{
  "family": "netwiredrc",
  "sample_count": 72,
  "category": "trojan",
  "description": "Backdoor:Win32/NetWiredRC is a potent, widely distributed Remote Access Trojan (RAT) known for its cross-platform capabilities, robust feature set, and frequent use in targeted cyber espionage, financial theft, and initial access brokerage.<br><br><b>Understanding NetWiredRC</b><br>To the victim, NetWiredRC operates silently, leaving no obvious visual footprint. For incident responders, NetWiredRC is a critical threat. Originally discovered around 2014, it is unique in its ability to support various OS environments (though Windows is the primary target). It provides the attacker with comprehensive control, including live desktop viewing, file management, remote shell access, and extensive credential theft capabilities.<br><br><b>Execution and Evasion Strategies</b><br>NetWiredRC is distributed through diverse vectors, primarily spearphishing campaigns (weaponized Office macros) and drive-by downloads. Upon execution, the RAT copies itself to a hidden folder in `%AppData%` and establishes persistence via the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key. It is highly adept at stealing credentials, actively targeting browser login data, email clients (Outlook, Thunderbird), and cryptocurrency wallets. It communicates with its C2 server using a custom, encrypted TCP protocol (often heavily obfuscated or padded to evade deep packet inspection). It frequently injects its core payload into legitimate processes like `notepad.exe` to mask its presence.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total endpoint compromise and massive data exfiltration. EDR alerts targeting 'Suspicious Process Injection' or 'Anomalous Network Activity from non-browser processes' are common. Threat hunters should analyze network logs for sustained, encrypted TCP connections over non-standard ports. The presence of hidden directories within `%AppData%` containing randomly named executables alongside keylogger log files (.dat or .txt) is a strong IoC. Memory analysis is critical to extract the decrypted configuration file containing the C2 IP addresses.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.001",
    "T1056.001",
    "T1071.001",
    "T1055",
    "T1555.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers",
      "tactic": "Credential Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately sever the endpoint from the network to terminate the active NetWiredRC session and halt data exfiltration.",
    "Do NOT reboot the machine immediately; capture a forensic memory image to extract the active configuration and C2 details.",
    "Force a global password reset for all accounts accessed by the user, as NetWiredRC aggressively targets saved browser and email credentials.",
    "Assume the machine is fully compromised; perform a clean operating system rebuild to ensure complete eradication."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the attacker has live access and can manually destroy evidence.",
    "Avoid relying solely on file deletion; NetWiredRC often runs in memory and will recreate deleted files if the injected process is not killed."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}