New Release: Decrypting Net Wire C2 Traffic
Summary: Unit 42 reverse engineered the TCP-based communication protocol of NetWire, a remote administration tool in the NetWiredDRC family that gives an attacker full control of Windows, Mac OS X, or Linux systems, and released a tool that decrypts its traffic and outputs attacker commands. The tool uses 256-bit AES in Output Feedback mode, with client and server session keys derived from a 32-byte seed exchanged at connection start combined with a static password the attacker sets when building the binary; NetWire supports 76 commands and sends a HeartBeat packet every 10 seconds.
Why it matters: The decoder needs the infected client's IP, the malware's port, and the encryption password - which defaults to "Password" - so incident responders can only read NetWire traffic if they can recover those details from the binary or the host.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026