nerbian | ipv[.]etl

Sharing

Copy URL Twitter E-mail

General

Target
ipv.etl
Size 2.3MB
Sample220623-j3tztsccem
SHA256 b3bf89c17580cab05931970666807dc24c18e6d22d86bfe83211ccdd86a0054a
MD5 288543bf797f4be5b66385aec5ed2e4f
SHA1 9ba54110203664c8b38cd842fc2cac0d60082a2d
SHA512 650f13ad1780a478d0d1586858f9e6c0af010ed087850956fc61903e609604ecb07b75a1c0ff5191bcb46fc3c3f718f84f646d54b207467ef9017981813c28bc
SSDEEP 49152:co9uNrAxNVMPsFT+Y33C5OLE0Fp9Og7MdYJPNf:nuSVMkl3Ci4q3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx nerbian

Malware Config

Signatures

Detect Nerbian RAT malware 1 IoCs

resource	yara_rule
static1/unpack002/out.upx	family_nerbian

Nerbian family
nerbian

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/MoUseCore.exe	upx

File Explorer

ipv.etl

.zip 2.3MB
MoUseCore.exe

.exe 620.8MB
out.upx

.exe 4.7MB

ipv.etl

SHA256 b3bf89c17580cab05931970666807dc24c18e6d22d86bfe83211ccdd86a0054a
MD5 288543bf797f4be5b66385aec5ed2e4f
SHA1 9ba54110203664c8b38cd842fc2cac0d60082a2d
SHA512 650f13ad1780a478d0d1586858f9e6c0af010ed087850956fc61903e609604ecb07b75a1c0ff5191bcb46fc3c3f718f84f646d54b207467ef9017981813c28bc
SSDEEP 49152:co9uNrAxNVMPsFT+Y33C5OLE0Fp9Og7MdYJPNf:nuSVMkl3Ci4q3
MD5 SHA1 SHA512 SSDEEP

MoUseCore.exe

SHA256 192d5612ca93f86b198fa39f05e33edca60bca2bb198a8263e0edbdbeae97710
MD5 ed5c36d81655a1744c7a8f710ed4a497
SHA1 cc08e68ae40c0a524b05e4936db86480b72d6631
SHA512 187e0569199673b63f3de39c3b982534aa829dcaefdef40c1f818067a88915796bedd4e314e9f381afb4c8189035cd8f8dc0eae5bb3860a4c5bd3743c687268e
SSDEEP 49152:wx3eRdmSC7N3DjjJEzAimq+/9YnFlugiTu:B7mSCJzjdEEeLlug
MD5 SHA1 SHA512 SSDEEP

windows x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Minor OS version

Major OS version

Entry point

5349072

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 944a143581fc0b5556d77cb3d0e02b470c07cea0beffee450b090c33ab4ac6a7
MD5 f8097d1e70727c28d193a87b25099c62
SHA1 7667531a98c21f21a2022a3d1cecac0419353bf9
SHA512 adb6cd7beebfbeaf51ab160fa0d1aedee6223b26f126cabc89703f02fc258bfb1c88af0c344e7677749b4b607a45e5bcb1863d1bbc5a9a544d36387154fa54eb
SSDEEP 98304:jfWSzsv04R2P3zZywnqmmDrD4wDhep44Xb9g4GKDAwdtnnmYBZxmLi9YExDVI2uu:juS8RWdqmmDrD4wDhep44Xb9g4GKDAwx
MD5 SHA1 SHA512 SSDEEP

windows x86

Detect Nerbian RAT malware

Minor OS version

Major OS version

Entry point

4282

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

219KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

306KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

91B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

992B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

167KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ