SYMBOLCOMMON_NAMEaka. SYNONYMS
win.smanager (Back to overview)

SManager

aka: PhantomNet

There is no description at this point.

References
2021-09-03Trend MicroMohamad Mokbel
@techreport{mokbel:20210903:state:df86499, author = {Mohamad Mokbel}, title = {{The State of SSL/TLS Certificate Usage in Malware C&C Communications}}, date = {2021-09-03}, institution = {Trend Micro}, url = {https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf}, language = {English}, urldate = {2021-09-19} } The State of SSL/TLS Certificate Usage in Malware C&C Communications
AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader
2021-08-03Group-IBAnastasia Tikhonova, Dmitry Kupin
@online{tikhonova:20210803:art:d715071, author = {Anastasia Tikhonova and Dmitry Kupin}, title = {{The Art of Cyberwarfare Chinese APTs attack Russia}}, date = {2021-08-03}, organization = {Group-IB}, url = {https://blog.group-ib.com/task}, language = {English}, urldate = {2021-08-06} } The Art of Cyberwarfare Chinese APTs attack Russia
Albaniiutas Mail-O SManager
2021-06-08SentinelOneJuan Andrés Guerrero-Saade
@online{guerrerosaade:20210608:thundercats:8eac3cd, author = {Juan Andrés Guerrero-Saade}, title = {{ThunderCats Hack the FSB | Your Taxes Didn’t Pay For This Op}}, date = {2021-06-08}, organization = {SentinelOne}, url = {https://labs.sentinelone.com/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op/}, language = {English}, urldate = {2021-06-09} } ThunderCats Hack the FSB | Your Taxes Didn’t Pay For This Op
Mail-O SManager Tmanger
2021-02-19Medium 0xthreatintel0xthreatintel
@online{0xthreatintel:20210219:how:5fed055, author = {0xthreatintel}, title = {{How to unpack SManager APT tool?}}, date = {2021-02-19}, organization = {Medium 0xthreatintel}, url = {https://0xthreatintel.medium.com/how-to-unpack-smanager-apt-tool-cb5909819214}, language = {English}, urldate = {2021-02-20} } How to unpack SManager APT tool?
SManager
2021-02-17VinCSSTrương Quốc Ngân
@online{ngn:20210217:re020:76db05d, author = {Trương Quốc Ngân}, title = {{[RE020] ElephantRAT (Kunming version): our latest discovered RAT of Panda and the similarities with recently Smanager RAT}}, date = {2021-02-17}, organization = {VinCSS}, url = {https://blog.vincss.net/2021/02/re020-elephantrat-kunming-version-our-latest-discovered-RAT-of-Panda.html}, language = {English}, urldate = {2021-02-20} } [RE020] ElephantRAT (Kunming version): our latest discovered RAT of Panda and the similarities with recently Smanager RAT
SManager
2021-01-26Medium 0xthreatintel0xthreatintel
@online{0xthreatintel:20210126:reversing:716c09c, author = {0xthreatintel}, title = {{Reversing APT Tool : SManager (Unpacked)}}, date = {2021-01-26}, organization = {Medium 0xthreatintel}, url = {https://0xthreatintel.medium.com/reversing-apt-tool-smanager-unpacked-d413a04961c4}, language = {English}, urldate = {2021-01-27} } Reversing APT Tool : SManager (Unpacked)
SManager
2020-12-25VinCSSTrương Quốc Ngân
@online{ngn:20201225:re0182:4a2ca92, author = {Trương Quốc Ngân}, title = {{[RE018-2] Analyzing new malware of China Panda hacker group used to attack supply chain against Vietnam Government Certification Authority - Part 2}}, date = {2020-12-25}, organization = {VinCSS}, url = {https://blog.vincss.net/2020/12/re018-2-analyzing-new-malware-of-china-panda-hacker-group-used-to-attack-supply-chain-against-vietnam-government-certification-authority.html?m=1}, language = {English}, urldate = {2020-12-26} } [RE018-2] Analyzing new malware of China Panda hacker group used to attack supply chain against Vietnam Government Certification Authority - Part 2
SManager
2020-12-19VinCSSTrương Quốc Ngân
@online{ngn:20201219:re0172:c0a6b21, author = {Trương Quốc Ngân}, title = {{[RE017-2] Phân tích kỹ thuật dòng mã độc mới được sử dụng để tấn công chuỗi cung ứng nhắm vào Ban Cơ yếu Chính phủ Việt Nam của nhóm tin tặc Panda Trung Quốc (Phần 2)}}, date = {2020-12-19}, organization = {VinCSS}, url = {https://blog.vincss.net/2020/12/re017-2-phan-tich-ky-thuat-dong-ma-doc-moi-co-nhieu-dau-hieu-lien-quan-toi-nhom-tin-tac-Panda.html}, language = {English}, urldate = {2020-12-19} } [RE017-2] Phân tích kỹ thuật dòng mã độc mới được sử dụng để tấn công chuỗi cung ứng nhắm vào Ban Cơ yếu Chính phủ Việt Nam của nhóm tin tặc Panda Trung Quốc (Phần 2)
SManager
2020-12-19VinCSSTrương Quốc Ngân
@online{ngn:20201219:re0181:bd0904c, author = {Trương Quốc Ngân}, title = {{[RE018-1] Analyzing new malware of China Panda hacker group used to attack supply chain against Vietnam Government Certification Authority - Part 1}}, date = {2020-12-19}, organization = {VinCSS}, url = {https://blog.vincss.net/2020/12/re018-1-analyzing-new-malware-of-china-panda-hacker-group-used-to-attack-supply-chain-against-vietnam-government-certification-authority.html}, language = {English}, urldate = {2020-12-23} } [RE018-1] Analyzing new malware of China Panda hacker group used to attack supply chain against Vietnam Government Certification Authority - Part 1
SManager
2020-12-17VinCSSVinCSS
@online{vincss:20201217:re0171:a4d3525, author = {VinCSS}, title = {{[RE017-1] Phân tích kỹ thuật dòng mã độc mới được sử dụng để tấn công chuỗi cung ứng nhắm vào Ban Cơ yếu Chính phủ Việt Nam của nhóm tin tặc Panda Trung Quốc (Phần 1)}}, date = {2020-12-17}, organization = {VinCSS}, url = {https://blog.vincss.net/2020/12/phan-tich-ky-thuat-dong-ma-doc-moi-co-nhieu-dau-hieu-lien-quan-toi-nhom-tin-tac-Panda.html}, language = {Vietnamese}, urldate = {2020-12-19} } [RE017-1] Phân tích kỹ thuật dòng mã độc mới được sử dụng để tấn công chuỗi cung ứng nhắm vào Ban Cơ yếu Chính phủ Việt Nam của nhóm tin tặc Panda Trung Quốc (Phần 1)
SManager
2020-12-17ESET ResearchIgnacio Sanmillan, Matthieu Faou
@online{sanmillan:20201217:operation:6822847, author = {Ignacio Sanmillan and Matthieu Faou}, title = {{Operation SignSight: Supply‑chain attack against a certification authority in Southeast Asia}}, date = {2020-12-17}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2020/12/17/operation-signsight-supply-chain-attack-southeast-asia/}, language = {English}, urldate = {2020-12-18} } Operation SignSight: Supply‑chain attack against a certification authority in Southeast Asia
SManager
2020-12-11NTT SecurityHiroki Hada
@online{hada:20201211:pandas:b182e4e, author = {Hiroki Hada}, title = {{Panda’s New Arsenal: Part 3 Smanager}}, date = {2020-12-11}, organization = {NTT Security}, url = {https://insight-jp.nttsecurity.com/post/102glv5/pandas-new-arsenal-part-3-smanager}, language = {Japanese}, urldate = {2021-01-01} } Panda’s New Arsenal: Part 3 Smanager
FunnyDream SManager Tmanger
Yara Rules
[TLP:WHITE] win_smanager_auto (20211008 | Detects win.smanager.)
rule win_smanager_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.smanager."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smanager"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 6a0d e8???????? 83c404 8bf0 }
            // n = 4, score = 600
            //   6a0d                 | push                0xd
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   8bf0                 | mov                 esi, eax

        $sequence_1 = { 6a00 ff15???????? 8bf8 897e28 }
            // n = 4, score = 600
            //   6a00                 | push                0
            //   ff15????????         |                     
            //   8bf8                 | mov                 edi, eax
            //   897e28               | mov                 dword ptr [esi + 0x28], edi

        $sequence_2 = { 51 51 ffd0 83c40c c7460800000000 }
            // n = 5, score = 600
            //   51                   | push                ecx
            //   51                   | push                ecx
            //   ffd0                 | call                eax
            //   83c40c               | add                 esp, 0xc
            //   c7460800000000       | mov                 dword ptr [esi + 8], 0

        $sequence_3 = { 8b4510 85c0 7407 50 ff15???????? }
            // n = 5, score = 600
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]
            //   85c0                 | test                eax, eax
            //   7407                 | je                  9
            //   50                   | push                eax
            //   ff15????????         |                     

        $sequence_4 = { 83c602 6a22 56 e8???????? 83c408 }
            // n = 5, score = 600
            //   83c602               | add                 esi, 2
            //   6a22                 | push                0x22
            //   56                   | push                esi
            //   e8????????           |                     
            //   83c408               | add                 esp, 8

        $sequence_5 = { 8b4608 85c0 7420 a801 }
            // n = 4, score = 600
            //   8b4608               | mov                 eax, dword ptr [esi + 8]
            //   85c0                 | test                eax, eax
            //   7420                 | je                  0x22
            //   a801                 | test                al, 1

        $sequence_6 = { 8b7604 6a00 6a00 56 }
            // n = 4, score = 600
            //   8b7604               | mov                 esi, dword ptr [esi + 4]
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   56                   | push                esi

        $sequence_7 = { 33cc e8???????? 8be5 5d c20c00 6a04 }
            // n = 6, score = 600
            //   33cc                 | xor                 ecx, esp
            //   e8????????           |                     
            //   8be5                 | mov                 esp, ebp
            //   5d                   | pop                 ebp
            //   c20c00               | ret                 0xc
            //   6a04                 | push                4

        $sequence_8 = { ff15???????? 32c0 e9???????? 0f1005???????? }
            // n = 4, score = 300
            //   ff15????????         |                     
            //   32c0                 | xor                 al, al
            //   e9????????           |                     
            //   0f1005????????       |                     

        $sequence_9 = { 0007 b15a 0007 b15a }
            // n = 4, score = 100
            //   0007                 | add                 byte ptr [edi], al
            //   b15a                 | mov                 cl, 0x5a
            //   0007                 | add                 byte ptr [edi], al
            //   b15a                 | mov                 cl, 0x5a

        $sequence_10 = { 0007 b15a 00c4 b15a }
            // n = 4, score = 100
            //   0007                 | add                 byte ptr [edi], al
            //   b15a                 | mov                 cl, 0x5a
            //   00c4                 | add                 ah, al
            //   b15a                 | mov                 cl, 0x5a

        $sequence_11 = { 0000 0c0c 0c0c 0c0c 0c0c 0c0c 0102 }
            // n = 7, score = 100
            //   0000                 | add                 byte ptr [eax], al
            //   0c0c                 | or                  al, 0xc
            //   0c0c                 | or                  al, 0xc
            //   0c0c                 | or                  al, 0xc
            //   0c0c                 | or                  al, 0xc
            //   0c0c                 | or                  al, 0xc
            //   0102                 | add                 dword ptr [edx], eax

        $sequence_12 = { c745d010000000 c705????????03000000 c745d403000000 48c745d807000000 895de0 }
            // n = 5, score = 100
            //   c745d010000000       | dec                 eax
            //   c705????????03000000     |     
            //   c745d403000000       | mov                 ecx, dword ptr [ebx + 0x30]
            //   48c745d807000000     | dec                 eax
            //   895de0               | mov                 eax, dword ptr [ecx]

        $sequence_13 = { 488d55d0 e9???????? 488b0d???????? 33db 488d55d0 c745d010000000 }
            // n = 6, score = 100
            //   488d55d0             | jmp                 0xf
            //   e9????????           |                     
            //   488b0d????????       |                     
            //   33db                 | inc                 ecx
            //   488d55d0             | mov                 ebx, dword ptr [esi + 0x10]
            //   c745d010000000       | dec                 ecx

        $sequence_14 = { 418b7610 498d1c07 4903f7 eb0a 418b5e10 4903df }
            // n = 6, score = 100
            //   418b7610             | inc                 ecx
            //   498d1c07             | mov                 esi, dword ptr [esi + 0x10]
            //   4903f7               | dec                 ecx
            //   eb0a                 | lea                 ebx, dword ptr [edi + eax]
            //   418b5e10             | dec                 ecx
            //   4903df               | add                 esi, edi

        $sequence_15 = { 488b18 483bd8 0f84e0000000 90 488b4b30 488b01 }
            // n = 6, score = 100
            //   488b18               | add                 ebx, edi
            //   483bd8               | dec                 eax
            //   0f84e0000000         | lea                 edx, dword ptr [ebp - 0x30]
            //   90                   | xor                 ebx, ebx
            //   488b4b30             | dec                 eax
            //   488b01               | lea                 edx, dword ptr [ebp - 0x30]

        $sequence_16 = { 0001 ce 50 0008 }
            // n = 4, score = 100
            //   0001                 | add                 byte ptr [ecx], al
            //   ce                   | into                
            //   50                   | push                eax
            //   0008                 | add                 byte ptr [eax], cl

        $sequence_17 = { 0008 53 4f 00ef }
            // n = 4, score = 100
            //   0008                 | add                 byte ptr [eax], cl
            //   53                   | push                ebx
            //   4f                   | dec                 edi
            //   00ef                 | add                 bh, ch

        $sequence_18 = { 488bc3 488b5c2430 4883c420 5f c3 488d0dbbbe0100 }
            // n = 6, score = 100
            //   488bc3               | mov                 edi, edx
            //   488b5c2430           | dec                 esp
            //   4883c420             | lea                 eax, dword ptr [esp + 0x30]
            //   5f                   | xor                 ecx, ecx
            //   c3                   | dec                 eax
            //   488d0dbbbe0100       | add                 edx, 0x132

        $sequence_19 = { 33db 8919 b902020000 488d5590 ff15???????? e8???????? }
            // n = 6, score = 100
            //   33db                 | push                edi
            //   8919                 | dec                 eax
            //   b902020000           | sub                 esp, 0x20
            //   488d5590             | dec                 eax
            //   ff15????????         |                     
            //   e8????????           |                     

        $sequence_20 = { 0000 80ed4a 0044feff ff900100008c }
            // n = 4, score = 100
            //   0000                 | add                 byte ptr [eax], al
            //   80ed4a               | sub                 ch, 0x4a
            //   0044feff             | add                 byte ptr [esi + edi*8 - 1], al
            //   ff900100008c         | call                dword ptr [eax - 0x73ffffff]

        $sequence_21 = { 57 4883ec20 488bfa 4c8d442430 33c9 4881c232010000 c744243020000000 }
            // n = 7, score = 100
            //   57                   | mov                 dword ptr [ebp - 0x30], 0x10
            //   4883ec20             | dec                 eax
            //   488bfa               | mov                 ebx, dword ptr [eax]
            //   4c8d442430           | dec                 eax
            //   33c9                 | cmp                 ebx, eax
            //   4881c232010000       | je                  0xe9
            //   c744243020000000     | nop                 

        $sequence_22 = { 0007 b15a 0089b05a0089 b05a }
            // n = 4, score = 100
            //   0007                 | add                 byte ptr [edi], al
            //   b15a                 | mov                 cl, 0x5a
            //   0089b05a0089         | add                 byte ptr [ecx - 0x76ffa550], cl
            //   b05a                 | mov                 al, 0x5a

        $sequence_23 = { 0003 b157 0000 0c0c }
            // n = 4, score = 100
            //   0003                 | add                 byte ptr [ebx], al
            //   b157                 | mov                 cl, 0x57
            //   0000                 | add                 byte ptr [eax], al
            //   0c0c                 | or                  al, 0xc

    condition:
        7 of them and filesize < 10013696
}
Download all Yara Rules