NetWire RAT malware
NetWire is a long-standing cross-platform remote access trojan used for credential theft and remote control, often delivered through phishing and crypters.
Malva.RE has analysed 4 public samples tagged NetWire RAT, statically and without execution. The latest public sample was seen on 2026-09-27.
File types
- PE Executable2
- ZIP Archive1
- AutoIt Compiled Script1
Recurring C2 endpoints
Wealthy2019[.]com[.]strangled[.]net:201901wealthyme[.]ddns[.]net:201901solution[.]myddns[.]me:20221
Defanged. Extracted statically from the configurations of public samples.
Latest public NetWire RAT samples
| Sample | Type | First seen |
|---|---|---|
| e596237b4036cf7a055edb402aff1f5a07852d6e2276836996654a6056820ebf | ZIP Archive | 2026-09-27 |
| d98322a279a554b9c24fc637a27534e1ae139382f84ad2de580096a71a35b3bd | PE Executable | 2026-04-24 |
| dc9cf86ceacb019977da48abbf347e054a430a97ab28a96fa30305d2a2f84dfb | AutoIt Compiled Script | 2026-03-23 |
| 73cf4c1de3510d4010419a34a87b341c18d6144080988d23abe965bed3d73a5e | PE Executable | 2026-01-24 |
Analyse your own NetWire RAT sample
Malva.RE unpacks, decompiles and extracts the configuration of suspicious files statically — the file is never executed. Free-plan reports are public.
Analyse a file for free