SYMBOLCOMMON_NAMEaka. SYNONYMS
win.smanager (Back to overview)

SManager

aka: PhantomNet

There is no description at this point.

References
2021-09-03Trend MicroMohamad Mokbel
@techreport{mokbel:20210903:state:df86499, author = {Mohamad Mokbel}, title = {{The State of SSL/TLS Certificate Usage in Malware C&C Communications}}, date = {2021-09-03}, institution = {Trend Micro}, url = {https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf}, language = {English}, urldate = {2021-09-19} } The State of SSL/TLS Certificate Usage in Malware C&C Communications
AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader
2021-08-03Group-IBAnastasia Tikhonova, Dmitry Kupin
@online{tikhonova:20210803:art:d715071, author = {Anastasia Tikhonova and Dmitry Kupin}, title = {{The Art of Cyberwarfare Chinese APTs attack Russia}}, date = {2021-08-03}, organization = {Group-IB}, url = {https://blog.group-ib.com/task}, language = {English}, urldate = {2021-08-06} } The Art of Cyberwarfare Chinese APTs attack Russia
Albaniiutas Mail-O SManager TA428
2021-06-08SentinelOneJuan Andrés Guerrero-Saade
@online{guerrerosaade:20210608:thundercats:8eac3cd, author = {Juan Andrés Guerrero-Saade}, title = {{ThunderCats Hack the FSB | Your Taxes Didn’t Pay For This Op}}, date = {2021-06-08}, organization = {SentinelOne}, url = {https://labs.sentinelone.com/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op/}, language = {English}, urldate = {2021-06-09} } ThunderCats Hack the FSB | Your Taxes Didn’t Pay For This Op
Mail-O SManager Tmanger
2021-02-19Medium 0xthreatintel0xthreatintel
@online{0xthreatintel:20210219:how:5fed055, author = {0xthreatintel}, title = {{How to unpack SManager APT tool?}}, date = {2021-02-19}, organization = {Medium 0xthreatintel}, url = {https://0xthreatintel.medium.com/how-to-unpack-smanager-apt-tool-cb5909819214}, language = {English}, urldate = {2021-02-20} } How to unpack SManager APT tool?
SManager
2021-02-17VinCSSTrương Quốc Ngân
@online{ngn:20210217:re020:76db05d, author = {Trương Quốc Ngân}, title = {{[RE020] ElephantRAT (Kunming version): our latest discovered RAT of Panda and the similarities with recently Smanager RAT}}, date = {2021-02-17}, organization = {VinCSS}, url = {https://blog.vincss.net/2021/02/re020-elephantrat-kunming-version-our-latest-discovered-RAT-of-Panda.html}, language = {English}, urldate = {2021-02-20} } [RE020] ElephantRAT (Kunming version): our latest discovered RAT of Panda and the similarities with recently Smanager RAT
SManager
2021-01-26Medium 0xthreatintel0xthreatintel
@online{0xthreatintel:20210126:reversing:716c09c, author = {0xthreatintel}, title = {{Reversing APT Tool : SManager (Unpacked)}}, date = {2021-01-26}, organization = {Medium 0xthreatintel}, url = {https://0xthreatintel.medium.com/reversing-apt-tool-smanager-unpacked-d413a04961c4}, language = {English}, urldate = {2021-01-27} } Reversing APT Tool : SManager (Unpacked)
SManager
2020-12-25VinCSSTrương Quốc Ngân
@online{ngn:20201225:re0182:4a2ca92, author = {Trương Quốc Ngân}, title = {{[RE018-2] Analyzing new malware of China Panda hacker group used to attack supply chain against Vietnam Government Certification Authority - Part 2}}, date = {2020-12-25}, organization = {VinCSS}, url = {https://blog.vincss.net/2020/12/re018-2-analyzing-new-malware-of-china-panda-hacker-group-used-to-attack-supply-chain-against-vietnam-government-certification-authority.html?m=1}, language = {English}, urldate = {2020-12-26} } [RE018-2] Analyzing new malware of China Panda hacker group used to attack supply chain against Vietnam Government Certification Authority - Part 2
SManager
2020-12-19VinCSSTrương Quốc Ngân
@online{ngn:20201219:re0181:bd0904c, author = {Trương Quốc Ngân}, title = {{[RE018-1] Analyzing new malware of China Panda hacker group used to attack supply chain against Vietnam Government Certification Authority - Part 1}}, date = {2020-12-19}, organization = {VinCSS}, url = {https://blog.vincss.net/2020/12/re018-1-analyzing-new-malware-of-china-panda-hacker-group-used-to-attack-supply-chain-against-vietnam-government-certification-authority.html}, language = {English}, urldate = {2020-12-23} } [RE018-1] Analyzing new malware of China Panda hacker group used to attack supply chain against Vietnam Government Certification Authority - Part 1
SManager
2020-12-19VinCSSTrương Quốc Ngân
@online{ngn:20201219:re0172:c0a6b21, author = {Trương Quốc Ngân}, title = {{[RE017-2] Phân tích kỹ thuật dòng mã độc mới được sử dụng để tấn công chuỗi cung ứng nhắm vào Ban Cơ yếu Chính phủ Việt Nam của nhóm tin tặc Panda Trung Quốc (Phần 2)}}, date = {2020-12-19}, organization = {VinCSS}, url = {https://blog.vincss.net/2020/12/re017-2-phan-tich-ky-thuat-dong-ma-doc-moi-co-nhieu-dau-hieu-lien-quan-toi-nhom-tin-tac-Panda.html}, language = {English}, urldate = {2020-12-19} } [RE017-2] Phân tích kỹ thuật dòng mã độc mới được sử dụng để tấn công chuỗi cung ứng nhắm vào Ban Cơ yếu Chính phủ Việt Nam của nhóm tin tặc Panda Trung Quốc (Phần 2)
SManager
2020-12-17ESET ResearchIgnacio Sanmillan, Matthieu Faou
@online{sanmillan:20201217:operation:6822847, author = {Ignacio Sanmillan and Matthieu Faou}, title = {{Operation SignSight: Supply‑chain attack against a certification authority in Southeast Asia}}, date = {2020-12-17}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2020/12/17/operation-signsight-supply-chain-attack-southeast-asia/}, language = {English}, urldate = {2020-12-18} } Operation SignSight: Supply‑chain attack against a certification authority in Southeast Asia
SManager
2020-12-17VinCSSVinCSS
@online{vincss:20201217:re0171:a4d3525, author = {VinCSS}, title = {{[RE017-1] Phân tích kỹ thuật dòng mã độc mới được sử dụng để tấn công chuỗi cung ứng nhắm vào Ban Cơ yếu Chính phủ Việt Nam của nhóm tin tặc Panda Trung Quốc (Phần 1)}}, date = {2020-12-17}, organization = {VinCSS}, url = {https://blog.vincss.net/2020/12/phan-tich-ky-thuat-dong-ma-doc-moi-co-nhieu-dau-hieu-lien-quan-toi-nhom-tin-tac-Panda.html}, language = {Vietnamese}, urldate = {2020-12-19} } [RE017-1] Phân tích kỹ thuật dòng mã độc mới được sử dụng để tấn công chuỗi cung ứng nhắm vào Ban Cơ yếu Chính phủ Việt Nam của nhóm tin tặc Panda Trung Quốc (Phần 1)
SManager
2020-12-11NTT SecurityHiroki Hada
@online{hada:20201211:pandas:b182e4e, author = {Hiroki Hada}, title = {{Panda’s New Arsenal: Part 3 Smanager}}, date = {2020-12-11}, organization = {NTT Security}, url = {https://insight-jp.nttsecurity.com/post/102glv5/pandas-new-arsenal-part-3-smanager}, language = {Japanese}, urldate = {2021-01-01} } Panda’s New Arsenal: Part 3 Smanager
FunnyDream SManager Tmanger
Yara Rules
[TLP:WHITE] win_smanager_auto (20230715 | Detects win.smanager.)
rule win_smanager_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-07-11"
        version = "1"
        description = "Detects win.smanager."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smanager"
        malpedia_rule_date = "20230705"
        malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
        malpedia_version = "20230715"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c7462cffffffff 7410 6a00 6a00 6830001100 }
            // n = 5, score = 600
            //   c7462cffffffff       | mov                 dword ptr [esi + 0x2c], 0xffffffff
            //   7410                 | je                  0x12
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   6830001100           | push                0x110030

        $sequence_1 = { 8b4510 85c0 7407 50 ff15???????? }
            // n = 5, score = 600
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]
            //   85c0                 | test                eax, eax
            //   7407                 | je                  9
            //   50                   | push                eax
            //   ff15????????         |                     

        $sequence_2 = { 8b7604 6a00 6a00 56 68???????? }
            // n = 5, score = 600
            //   8b7604               | mov                 esi, dword ptr [esi + 4]
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   56                   | push                esi
            //   68????????           |                     

        $sequence_3 = { 8b4608 85c0 7420 a801 }
            // n = 4, score = 600
            //   8b4608               | mov                 eax, dword ptr [esi + 8]
            //   85c0                 | test                eax, eax
            //   7420                 | je                  0x22
            //   a801                 | test                al, 1

        $sequence_4 = { 6a0d e8???????? 83c404 8bf0 }
            // n = 4, score = 600
            //   6a0d                 | push                0xd
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   8bf0                 | mov                 esi, eax

        $sequence_5 = { 6a00 6a00 ff15???????? 8bf8 897e28 }
            // n = 5, score = 600
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   ff15????????         |                     
            //   8bf8                 | mov                 edi, eax
            //   897e28               | mov                 dword ptr [esi + 0x28], edi

        $sequence_6 = { 83c602 6a22 56 e8???????? 83c408 85c0 }
            // n = 6, score = 600
            //   83c602               | add                 esi, 2
            //   6a22                 | push                0x22
            //   56                   | push                esi
            //   e8????????           |                     
            //   83c408               | add                 esp, 8
            //   85c0                 | test                eax, eax

        $sequence_7 = { 740e 3d45270000 7407 3d46270000 }
            // n = 4, score = 600
            //   740e                 | je                  0x10
            //   3d45270000           | cmp                 eax, 0x2745
            //   7407                 | je                  9
            //   3d46270000           | cmp                 eax, 0x2746

        $sequence_8 = { ff15???????? 32c0 e9???????? 0f1005???????? }
            // n = 4, score = 300
            //   ff15????????         |                     
            //   32c0                 | xor                 al, al
            //   e9????????           |                     
            //   0f1005????????       |                     

        $sequence_9 = { 0007 b15a 0007 b15a }
            // n = 4, score = 100
            //   0007                 | add                 byte ptr [ebx], al
            //   b15a                 | mov                 cl, 0x57
            //   0007                 | add                 byte ptr [eax], al
            //   b15a                 | or                  al, 0xc

        $sequence_10 = { 0003 b157 0000 0c0c }
            // n = 4, score = 100
            //   0003                 | add                 byte ptr [ecx], al
            //   b157                 | into                
            //   0000                 | push                eax
            //   0c0c                 | add                 byte ptr [eax], cl

        $sequence_11 = { 720a 488b4c2448 e8???????? 488b8d70010000 4833cc e8???????? }
            // n = 6, score = 100
            //   720a                 | test                eax, eax
            //   488b4c2448           | cmp                 eax, 0x57
            //   e8????????           |                     
            //   488b8d70010000       | jne                 0x1e6
            //   4833cc               | dec                 eax
            //   e8????????           |                     

        $sequence_12 = { 0000 0c0c 0c0c 0c0c 0c0c 0c0c 0102 }
            // n = 7, score = 100
            //   0000                 | push                0xd
            //   0c0c                 | add                 esp, 4
            //   0c0c                 | mov                 esi, eax
            //   0c0c                 | mov                 esi, dword ptr [esi + 4]
            //   0c0c                 | push                0
            //   0c0c                 | push                0
            //   0102                 | push                esi

        $sequence_13 = { 4c8bc6 ba57000000 488bcf e8???????? 488bd8 4885c0 7463 }
            // n = 7, score = 100
            //   4c8bc6               | dec                 esp
            //   ba57000000           | mov                 eax, esi
            //   488bcf               | mov                 edx, 0x57
            //   e8????????           |                     
            //   488bd8               | dec                 eax
            //   4885c0               | mov                 ecx, edi
            //   7463                 | dec                 eax

        $sequence_14 = { ff5308 83f801 7512 b001 }
            // n = 4, score = 100
            //   ff5308               | lea                 ecx, [0xc2ec]
            //   83f801               | inc                 ebp
            //   7512                 | xor                 eax, eax
            //   b001                 | xor                 edx, edx

        $sequence_15 = { 0008 53 4f 00ef }
            // n = 4, score = 100
            //   0008                 | add                 byte ptr [edi], al
            //   53                   | mov                 cl, 0x5a
            //   4f                   | add                 ah, al
            //   00ef                 | mov                 cl, 0x5a

        $sequence_16 = { 83f857 0f85e0010000 488d0decc20000 4533c0 33d2 ff15???????? }
            // n = 6, score = 100
            //   83f857               | mov                 ecx, esi
            //   0f85e0010000         | mov                 edx, ebx
            //   488d0decc20000       | dec                 eax
            //   4533c0               | mov                 dword ptr [esp + 0x28], edi
            //   33d2                 | dec                 esp
            //   ff15????????         |                     

        $sequence_17 = { 488d442450 4533c9 448d4307 488bce 8bd3 48897c2428 }
            // n = 6, score = 100
            //   488d442450           | mov                 ebx, eax
            //   4533c9               | dec                 eax
            //   448d4307             | test                eax, eax
            //   488bce               | je                  0x65
            //   8bd3                 | dec                 eax
            //   48897c2428           | lea                 eax, [esp + 0x50]

        $sequence_18 = { 0007 b15a 00c4 b15a }
            // n = 4, score = 100
            //   0007                 | add                 byte ptr [edi], al
            //   b15a                 | mov                 cl, 0x5a
            //   00c4                 | add                 byte ptr [ecx - 0x76ffa550], cl
            //   b15a                 | mov                 al, 0x5a

        $sequence_19 = { 4883ec20 8bf9 e8???????? 4885c0 7509 488d0593870100 eb04 }
            // n = 7, score = 100
            //   4883ec20             | sub                 edx, 0x110020
            //   8bf9                 | je                  0x8f
            //   e8????????           |                     
            //   4885c0               | sub                 edx, 0x10
            //   7509                 | je                  0x84
            //   488d0593870100       | sub                 edx, 0x10
            //   eb04                 | je                  0x71

        $sequence_20 = { 81ea20001100 0f8489000000 83ea10 7479 83ea10 7461 83ea30 }
            // n = 7, score = 100
            //   81ea20001100         | mov                 eax, esi
            //   0f8489000000         | mov                 edx, 0x4d
            //   83ea10               | dec                 eax
            //   7479                 | mov                 ecx, edi
            //   83ea10               | dec                 eax
            //   7461                 | mov                 ebx, eax
            //   83ea30               | dec                 eax

        $sequence_21 = { 0007 b15a 0089b05a0089 b05a }
            // n = 4, score = 100
            //   0007                 | add                 byte ptr [edi], al
            //   b15a                 | mov                 cl, 0x5a
            //   0089b05a0089         | add                 byte ptr [edi], al
            //   b05a                 | mov                 cl, 0x5a

        $sequence_22 = { 0000 80ed4a 0044feff ff900100008c }
            // n = 4, score = 100
            //   0000                 | push                0
            //   80ed4a               | push                0
            //   0044feff             | push                0
            //   ff900100008c         | mov                 edi, eax

        $sequence_23 = { 0001 ce 50 0008 }
            // n = 4, score = 100
            //   0001                 | add                 byte ptr [eax], al
            //   ce                   | sub                 ch, 0x4a
            //   50                   | add                 byte ptr [esi + edi*8 - 1], al
            //   0008                 | call                dword ptr [eax - 0x73ffffff]

    condition:
        7 of them and filesize < 10013696
}
Download all Yara Rules