Nerbian RAT Targets Victims in Europe

A new strain of malware has recently been documented by security researchers. The threat was called Nerbian and exhibits features typical of remote access trojan, hence the full name Nerbian RAT.

Perhaps a little late to the party, Nerbian RAT is being spread through a phishing email campaign that uses lures related to Covid-19. The campaign appears to have been targeted, given its relatively low volume. Researchers pinpointed the start of the phishing campaign as the last week of April 2022.

The malware has a number of features that help it avoid automated detection, including "several encryption routines".

The malicious emails pretend to originate from the World Health Organization and contain a malicious document file attached. The file includes bulleted lists of things to do if you have Covid symptoms and instructions on how to self-isolate properly, as well as malicious macros that will ask for permission to execute before displaying the document's text.

Once the macro executes, it downloads a malicious executable named "UpdateUAV.exe". This is the dropper component of the Nerbian RAT attack chain. The final payload is contained in a file named "MoUsoCore.exe".

The malware is equipped with functionality that will shut the process down if analytical tools and debuggers attempt to interact with it.

Nerbian RAT itself has decent capabilities, including logging keyboard inputs, taking screenshots, and accepting remote commands, as well as exfiltrating data to its C2 servers.

The RAT was used to target entities in several European countries, including Spain, Italy and the United Kingdom.