TF-2013289
high
📛 Threat Title
NetWire RC: SHA256 hash of a malware sample (payload) 2513641573e48d63aadac514a11bf76bb5dd2c764b7095cc8fc9450b09d4ad75
Description
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: NetWire RC (aliases: NetWeird,NetWire,Recam). Confidence: 95. First seen: 2026-11-03 16:42:32 UTC. Reporter: Grim.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
2513641573e48d63aadac514a11bf76bb5dd2c764b7095cc8fc9450b09d4ad75
IOC database
- Type
- hash_sha256
- Value
2513641573e48d63aadac514a11bf76bb5dd2c764b7095cc8fc9450b09d4ad75- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- ConnectWise
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: NetWire RC (aliases: NetWeird,NetWire,Recam). Confidence: 95. First seen: 2026-11-03 16:42:32 UTC. Reporter: Grim.
Remediations (10)
-
web:bazaar.abuse.ch
A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as NetWire .
-
web:bazaar.abuse.ch
Information on NetWire malware sample ( SHA256 3f2520949a57c9b6342f6e6a3f13f56c124bddcd576d3a652aa237b6913e3b4f) MalwareBazaar uses YARA rules from several public and ...
-
web:cipherssecurity.com
Check MD5, SHA-1, or SHA-256 file hashes against MalwareBazaar and VirusTotal feeds. Drop a file — hashing happens in your browser, never uploaded.
-
web:cybersight-security.github.io
NETWire is a remote access trojan (RAT) designed to provide cybercriminals with unauthorized access and control over infected systems. It is a versatile malware tool commonly used in cyber attacks to steal sensitive information, monitor user activity, and execute malicious commands remotely.
-
web:github.com
This repository contains 130 malware and ransomware samples for research and analysis purposes. - Malware - Samples / Samples / NETWire at main · Cybersight-Security ...
-
web:imalware.com
It compares a file's fingerprint (its MD5, SHA-1 or SHA-256 hash ) with a list of fingerprints of known malware . If the hash matches, the file is identical to a known malicious sample .
-
web:ismalicious.com
NetWire RC sample 867d4e1cd93f0019025c6a89682531c60e1c97f50d375a26c3634ce1ef4d6c68: listed by 3 threat sources ( malware , c2). File type, signatures, hashes, reports.
-
web:ismalicious.com
NetWire RC sample f48c7b7e0d129271d2d683ecf3df997ef8abd7cdb808f770cbd9aed2703ceecc: listed by 3 threat sources ( malware , c2). File type, signatures, hashes, reports.
-
web:threatfox.abuse.ch
NetWire RC IOC: 0b01016d6117a8a0af97c5a7a1f6e2241f0b2a31240628e8a70f6635e8386d20 ( sha256_hash ) ThreatFox IOC Database You are viewing the ThreatFox database entry for ...
-
web:threatfox.abuse.ch
NetWire RC IOC: b5332586088042aaef4fe1cb73931c9a125dc0f0ab8135912fd446818a019417 ( sha256_hash ) You are viewing the ThreatFox database entry for sha256_hash ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.