Nerbian RAT Using COVID-19 Themes Features Sophisticated Evasion Techniques
by Andrew Northern, Pim Trouerbach, Tony Robinson, Axel F
May 11, 2022
| Notes |
|---|
| Proofpoint |
| malware |
| anti-analysis |
| anti-reversing |
| Golang |
| RAT |
| Nerbian |
| COVID-19 |
| World Health Organization |
| malware using open source libraries |
| Nerbia – Don Quixote |
| Golang adoption by threat actors – low barrier to entry, ease of use |
| phishing |
| Italy, Spain, United Kingdom |
| pr0xylife |
| Twitter https://x.com/pr0xylife/status/1519704793593307136 |
| email attachment |
| who.inter.svc@gmail[.]com, announce@who-international[.]com |
| who_covid19.rar with who_covid19.doc inside, covid19guide.rar with covid19guide.doc inside, covid-19.doc |
| macro |
| Microsoft Word |
| RAR |
| phishing lure |
| Health Service Executive (HSE) |
| Ireland |
| National Council for the Blind of Ireland |
| batch (.bat) file |
| powershell IWR |
| UpdateUAV.exe |
| dropper |
| UPX |
| packer |
| K:/W_Work/Golang/src/RAT_Dropper/main_gen.go |
| main_downloadNerbian |
| code reuse, code reuse as attribution |
| go-ole/go-ole Component Object Module |
| gonutz/w32 Win32 API |
| mitchellh/go-ps |
| StackExchange/wmi WMI, WQL |
| p3tr0v/chacal |
| anti-debug, anti-vm, anti-forensics |
| GitHub |
| Chacal - “Golang anti-vm framework for Red Team and Pentesters” |
| anti-vm checks: |
| .. small hard disk size |
| .. name of hard disk contains “virtual”, “vbox”, “vmware” |
| .. MAC address has OUI: 00:0c:29, 00:50:56, 08:00:27, 52:54:00, 00:21:F6, 00:14:4F, 00:0F:4B, 00:10:E0, 00:00:7D, 00:21:28, 00:01:5D, 00:21:F6, 00:A0:A4, 00:07:82, 00:03:BA, 08:00:20, 2C:C2:60, 00:10:4F, 00:0F:4B, 00:13:97, 00:20:F2, 00:14:4F |
| .. process name contains: processhacker.exe, procmon.exe, pestudio.exe, procmon64.exe, x32dbg.exe, x64dbg.exe, CFF Explorer.exe, procexp64.exe, procexp.exe, pslist.exe, tcpview.exe, tcpvcon.exe, dbgview.exe, RAMMap.exe, RAMMap64.exe, vmmap.exe, ollydbg.exe, agent.py, autoruns.exe, autorunsc.exe, filemon.exe, regmon.exe, idaq.exe, idaq64.exe, ImmunityDebugger.exe, Wireshark.exe, dumpcap.exe, HookExplorer.exe, ImportREC.exe, PETools.exe, LordPE.exe, SysInspector.exe, proc_analyzer.exe, sysAnalyzer.exe, sniff_hit.exe, windbg.exe, joeboxcontrol.exe, joeboxserver.exe, joeboxserver.exe, ResourceHacker.exe, Fiddler.exe, httpdebugger.exe |
| .. memory analysis tools running: DumpIt.exe, RAMMap.exe, RAMMap64.exe, vmmap.exe |
| .. time measurement function |
| .. IsDebuggerPresent |
| .. NIC name contains: Intel® PRO/1000 MT Network Connection, Loopback Pseudo-Interface 1, Software Loopback Interface 1 |
| persistence |
| payload |
| hxxps://www[.] fernandestechnical [.]com/pub/media/ssl -> C:\ProgramData\USOShared\MoUsoCore.exe |
| scheduled task MicrosoftMouseCoreWork |
| malware encrypted configuration |
| malware working hours |
| working directory |
| command and control |
| keylogger |
| screen capture |
| screenshots: kbinani/screenshot |
| SSL |
| base64 |
| SMBIOS |
| malduck |
| binascii |
| Python Python malware |
| HTTP GET, HTTP POST |
| HTTP, HTTPS |
| AES |
| encryption |
| concatenation |
| go-smbios |
| maldoc |
| malware vetting target hosts |
| obfuscation |
| strings |
| IoCs: YARA, Snort, Suricata, hashes |