{"id":16391,"date":"2019-09-23T15:20:42","date_gmt":"2019-09-23T23:20:42","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2019\/09\/23\/news-10132\/"},"modified":"2019-09-23T15:20:42","modified_gmt":"2019-09-23T23:20:42","slug":"news-10132","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2019\/09\/23\/news-10132\/","title":{"rendered":"New NetWire RAT Variant Being Spread Via Phishing"},"content":{"rendered":"
\n
\n

A FortiGuard Labs Threat Analysis<\/i><\/p>\n

Background<\/h2>\n

NetWire is a Remote Access Trojan (RAT) malware that has been widely used for many years. Recently, FortiGuard Labs noticed a malware spreading via phishing email, and during the analysis on it, we discovered that it was a new variant of NetWire RAT.<\/p>\n

In this analysis, I am going to present what this new variant does on a victim\u2019s system.<\/p>\n

NetWire Being Spread via Phishing Email<\/h2>\n

Figure 1, below, is a screenshot of the phishing email content. It contains a PDF-like picture at the bottom with a hyperlink pointing to the download link of NetWire. Once a victim clicks on it, the malware file is downloaded on to the victim\u2019s system.\u00a0<\/p>\n<\/p><\/div>\n