Rewterz Threat Alert – NetWire RAT Malware – Active IOCs

Severity

High

Analysis Summary

A Netwire campaign targeting Italian industry. As the Netwire variant was common to known samples, the main focus of their reporting on the subject was the unique attack chain used to distribute the RAT. The campaign begins with an Italian language email and XLS attachment. This XLS attachment contains a macro that kicks off the infection chain if a user opts to enable macros. This macro simply downloads what appears to be an image file but instead is an XSL stylesheet containing JavaScript. The contained JavaScript downloads and executes a VBS file hosted on the same server as the fake image file. In turn, the VBS code fetches yet another payload from the remote server. This payload is downloaded as a .jpg and read by the VBS code as raw bytes that will eventually become executable PowerShell code. The PowerShell code provides two functions. First, it loads a DLL that can perform an AMSI bypass. Then, it loads a second DLL that can inject the Netwire payload into another process. Persistence is established via a Registry Run key. As mentioned, the final payload is the Netwire RAT, which provides attackers with the ability to steal information from victim machines, such as credentials, browser history, and keystrokes. The researchers note that similarities exist between the naming conventions of variables in the payloads from this campaign with those in Aggah campaigns targeting the Italian manufacturing industry.

Impact

• Information Theft
• Exposure of Sensitive Data

Indicators of Compromise

MD5

• 6e6ffc38d9c88ca34562e0369ac22a75
• a582f8176c5f4becf5f95a563e9ec11a
• 8c833f4b354a4f69fedc1c717dd0aed2

SHA-256

• 9a9ddbcb74bc37b8eb71fc0d4e3840e2e6435f7c9deb51f7e8e7f0bbd0cee473
• bd62e723aff056a5f6dd9b9ece4f5ea4bae0a50cc3bdd5f4228fb265c2a96170
• 466c6eed81c9e10b97b539264af394bef185fdfa72cd3550f62d6634dfb2acc3

SHA-1

• b8788ca1f0102145580e6cffe8528aa82105092d
• a8b2fd3f57157cce4fe9442b8ffa53e15ca4820c
• a0804214a59d6bd2d30888b4ae8f61f6745200de

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders.