NetWire Sample: 004F011B37E4446F

KEYDAL Güvenlik Araştırmaları Threat Intelligence Analyst

3 Temmuz 2026 ~1 min read

NetWire Malware Analysis

SHA256: 004f011b37e4446fa04b76aae537cc00f6588c0705839152ae2d8a837ef2b730

MD5: 1364844e0bfb349272c5050fb0e677e3

File Type: exe

Size: 3,391,296 byte

First Seen: 2021-11-19

AV Signature: NetWire

Imphash: 928ca23958b7b89682da5497b37038ac

Reported By: JAMESWT_WT

Tags: exe, NetWire, signed, ULTRA ACADEMY LTD

Static analysis: metadata-based (sample not downloaded)

NetWireRAT. 88-hex ChaCha20 key+nonce. Embedded PCRE regex engine. Credential pattern matching.

Malware Type

RAT

Programming Language

C2 Protocol

TCP

Target Systems

Windows/Linux/macOS

Uzaktan Erişim & Kontrol

Keylogger

Ekran Görüntüsü

Webcam Erişimi

Dosya Yönetimi

Süreç Yönetimi

Komut Yürütme

Kalıcılık Mekanizması

IOC — NetWire

# FILEPATH
004f011b37e4446fa04b76aae537cc00f6588c0705839152ae2d8a837ef2b730

Type	Value	Note
filepath	004f011b37e4446fa04b76aae537cc00f6588c0705839152ae2d8a837ef2b730	PDB