Essential information

Value / Name

20a499db1927933a6263091cb5e59220de40c99b

Confidence

100/100

Revoked

Yes

Valid from

12/05/2022 10:22

Valid until

15/08/2023 10:22

Pattern type

yara

Published

20/12/2025 19:33

Modified

20/12/2025 20:10

Author / Source

AlienVault

Description

No description.

Pattern

rule Nerbian_RAT   
   {   
    meta:    
    author = "ptrouerbach"   
    reference = "5e6c5a9fda2d20125f6f24e37e8a217a39ff0a5cfddc07ddfdb18049d9ea4597"   
    malfamily = "NerbianRAT"   
     strings:   
    $args_p = "p-" ascii   
    $args_s = "s-" ascii   
    $args_h = "h-" ascii   
    $args_P = "P-" ascii   
     $hardcoded_aes_key = { 17E87F581F1DF8D6129D65FD50CEB3DD6C4E1C223077CD7D4C595DA6C3DF92B2 }    
   $param_auth = "auth_post" ascii   
    $param_session = "session_key" ascii   
    $param_data = "data_post" ascii   
    $param_addr = "addr_post" ascii   
    $param_port = "port_post" ascii   
     condition:   
    uint16be(0) == 0x4D5A    
    and ($hardcoded_aes_key or (all of ($param*) and all of ($args*)))   
    and filesize < 10MB   
   }

Labels / Tags

Labels: antivm covid19 nerbian nerbian rat

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.