nerbian | 011c781cef00e6451e27af18a558c3b12fef80f9f49355add6f02b5f900a3e82 | Triage

Resubmissions

02-06-2022 17:00

220602-vhy9lacecp 10

12-05-2022 11:22

220512-ngjn7acee6 8

Analysis

max time kernel
66s
max time network
115s
platform
windows7_x64
resource
win7-20220414-en
submitted
02-06-2022 17:00

Sharing

Report Analysis Logs

General

Target

011c781cef00e6451e27af18a558c3b12fef80f9f49355add6f02b5f900a3e82.exe
Size

4.1MB
MD5

92c314b7692cb2b64512750ad7b3d1b4
SHA1

a9a80722656e7a40fac99cc7eca2956e234e70c2
SHA256

011c781cef00e6451e27af18a558c3b12fef80f9f49355add6f02b5f900a3e82
SHA512

5bb574b1651d4513b3c1e472861ec8b5ef12decab195affa0d5fa7ce4e8e4fa7c4fb0f79aad0676adc31f1fbac6a3eae3a2eb798137e8357e81cd700f15c2668

Score

10^/10

nerbian rat trojan upx

Malware Config

Signatures

Detect Nerbian RAT malware 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1016-54-0x0000000000DF0000-0x00000000015F7000-memory.dmp	family_nerbian
behavioral1/memory/1016-55-0x0000000000DF0000-0x00000000015F7000-memory.dmp	family_nerbian

Nerbian
Remote access trojan written in the Golang.
rat trojan nerbian

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1016-54-0x0000000000DF0000-0x00000000015F7000-memory.dmp	upx
behavioral1/memory/1016-55-0x0000000000DF0000-0x00000000015F7000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\011c781cef00e6451e27af18a558c3b12fef80f9f49355add6f02b5f900a3e82.exe
"C:\Users\Admin\AppData\Local\Temp\011c781cef00e6451e27af18a558c3b12fef80f9f49355add6f02b5f900a3e82.exe"
1⤵
PID:1016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-54-0x0000000000DF0000-0x00000000015F7000-memory.dmp

Filesize
8.0MB

Download
memory/1016-55-0x0000000000DF0000-0x00000000015F7000-memory.dmp

Filesize
8.0MB

Download