SYMBOLCOMMON_NAMEaka. SYNONYMS
win.smanager (Back to overview)

SManager

aka: PhantomNet

There is no description at this point.

References
2021-09-03Trend MicroMohamad Mokbel
@techreport{mokbel:20210903:state:df86499, author = {Mohamad Mokbel}, title = {{The State of SSL/TLS Certificate Usage in Malware C&C Communications}}, date = {2021-09-03}, institution = {Trend Micro}, url = {https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf}, language = {English}, urldate = {2021-09-19} } The State of SSL/TLS Certificate Usage in Malware C&C Communications
AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader
2021-08-03Group-IBAnastasia Tikhonova, Dmitry Kupin
@online{tikhonova:20210803:art:d715071, author = {Anastasia Tikhonova and Dmitry Kupin}, title = {{The Art of Cyberwarfare Chinese APTs attack Russia}}, date = {2021-08-03}, organization = {Group-IB}, url = {https://blog.group-ib.com/task}, language = {English}, urldate = {2021-08-06} } The Art of Cyberwarfare Chinese APTs attack Russia
Albaniiutas Mail-O SManager TA428
2021-06-08SentinelOneJuan Andrés Guerrero-Saade
@online{guerrerosaade:20210608:thundercats:8eac3cd, author = {Juan Andrés Guerrero-Saade}, title = {{ThunderCats Hack the FSB | Your Taxes Didn’t Pay For This Op}}, date = {2021-06-08}, organization = {SentinelOne}, url = {https://labs.sentinelone.com/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op/}, language = {English}, urldate = {2021-06-09} } ThunderCats Hack the FSB | Your Taxes Didn’t Pay For This Op
Mail-O SManager Tmanger
2021-02-19Medium 0xthreatintel0xthreatintel
@online{0xthreatintel:20210219:how:5fed055, author = {0xthreatintel}, title = {{How to unpack SManager APT tool?}}, date = {2021-02-19}, organization = {Medium 0xthreatintel}, url = {https://0xthreatintel.medium.com/how-to-unpack-smanager-apt-tool-cb5909819214}, language = {English}, urldate = {2021-02-20} } How to unpack SManager APT tool?
SManager
2021-02-17VinCSSTrương Quốc Ngân
@online{ngn:20210217:re020:76db05d, author = {Trương Quốc Ngân}, title = {{[RE020] ElephantRAT (Kunming version): our latest discovered RAT of Panda and the similarities with recently Smanager RAT}}, date = {2021-02-17}, organization = {VinCSS}, url = {https://blog.vincss.net/2021/02/re020-elephantrat-kunming-version-our-latest-discovered-RAT-of-Panda.html}, language = {English}, urldate = {2021-02-20} } [RE020] ElephantRAT (Kunming version): our latest discovered RAT of Panda and the similarities with recently Smanager RAT
SManager
2021-01-26Medium 0xthreatintel0xthreatintel
@online{0xthreatintel:20210126:reversing:716c09c, author = {0xthreatintel}, title = {{Reversing APT Tool : SManager (Unpacked)}}, date = {2021-01-26}, organization = {Medium 0xthreatintel}, url = {https://0xthreatintel.medium.com/reversing-apt-tool-smanager-unpacked-d413a04961c4}, language = {English}, urldate = {2021-01-27} } Reversing APT Tool : SManager (Unpacked)
SManager
2020-12-25VinCSSTrương Quốc Ngân
@online{ngn:20201225:re0182:4a2ca92, author = {Trương Quốc Ngân}, title = {{[RE018-2] Analyzing new malware of China Panda hacker group used to attack supply chain against Vietnam Government Certification Authority - Part 2}}, date = {2020-12-25}, organization = {VinCSS}, url = {https://blog.vincss.net/2020/12/re018-2-analyzing-new-malware-of-china-panda-hacker-group-used-to-attack-supply-chain-against-vietnam-government-certification-authority.html?m=1}, language = {English}, urldate = {2020-12-26} } [RE018-2] Analyzing new malware of China Panda hacker group used to attack supply chain against Vietnam Government Certification Authority - Part 2
SManager
2020-12-19VinCSSTrương Quốc Ngân
@online{ngn:20201219:re0181:bd0904c, author = {Trương Quốc Ngân}, title = {{[RE018-1] Analyzing new malware of China Panda hacker group used to attack supply chain against Vietnam Government Certification Authority - Part 1}}, date = {2020-12-19}, organization = {VinCSS}, url = {https://blog.vincss.net/2020/12/re018-1-analyzing-new-malware-of-china-panda-hacker-group-used-to-attack-supply-chain-against-vietnam-government-certification-authority.html}, language = {English}, urldate = {2020-12-23} } [RE018-1] Analyzing new malware of China Panda hacker group used to attack supply chain against Vietnam Government Certification Authority - Part 1
SManager
2020-12-19VinCSSTrương Quốc Ngân
@online{ngn:20201219:re0172:c0a6b21, author = {Trương Quốc Ngân}, title = {{[RE017-2] Phân tích kỹ thuật dòng mã độc mới được sử dụng để tấn công chuỗi cung ứng nhắm vào Ban Cơ yếu Chính phủ Việt Nam của nhóm tin tặc Panda Trung Quốc (Phần 2)}}, date = {2020-12-19}, organization = {VinCSS}, url = {https://blog.vincss.net/2020/12/re017-2-phan-tich-ky-thuat-dong-ma-doc-moi-co-nhieu-dau-hieu-lien-quan-toi-nhom-tin-tac-Panda.html}, language = {English}, urldate = {2020-12-19} } [RE017-2] Phân tích kỹ thuật dòng mã độc mới được sử dụng để tấn công chuỗi cung ứng nhắm vào Ban Cơ yếu Chính phủ Việt Nam của nhóm tin tặc Panda Trung Quốc (Phần 2)
SManager
2020-12-17ESET ResearchIgnacio Sanmillan, Matthieu Faou
@online{sanmillan:20201217:operation:6822847, author = {Ignacio Sanmillan and Matthieu Faou}, title = {{Operation SignSight: Supply‑chain attack against a certification authority in Southeast Asia}}, date = {2020-12-17}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2020/12/17/operation-signsight-supply-chain-attack-southeast-asia/}, language = {English}, urldate = {2020-12-18} } Operation SignSight: Supply‑chain attack against a certification authority in Southeast Asia
SManager
2020-12-17VinCSSVinCSS
@online{vincss:20201217:re0171:a4d3525, author = {VinCSS}, title = {{[RE017-1] Phân tích kỹ thuật dòng mã độc mới được sử dụng để tấn công chuỗi cung ứng nhắm vào Ban Cơ yếu Chính phủ Việt Nam của nhóm tin tặc Panda Trung Quốc (Phần 1)}}, date = {2020-12-17}, organization = {VinCSS}, url = {https://blog.vincss.net/2020/12/phan-tich-ky-thuat-dong-ma-doc-moi-co-nhieu-dau-hieu-lien-quan-toi-nhom-tin-tac-Panda.html}, language = {Vietnamese}, urldate = {2020-12-19} } [RE017-1] Phân tích kỹ thuật dòng mã độc mới được sử dụng để tấn công chuỗi cung ứng nhắm vào Ban Cơ yếu Chính phủ Việt Nam của nhóm tin tặc Panda Trung Quốc (Phần 1)
SManager
2020-12-11NTT SecurityHiroki Hada
@online{hada:20201211:pandas:b182e4e, author = {Hiroki Hada}, title = {{Panda’s New Arsenal: Part 3 Smanager}}, date = {2020-12-11}, organization = {NTT Security}, url = {https://insight-jp.nttsecurity.com/post/102glv5/pandas-new-arsenal-part-3-smanager}, language = {Japanese}, urldate = {2021-01-01} } Panda’s New Arsenal: Part 3 Smanager
FunnyDream SManager Tmanger
Yara Rules
[TLP:WHITE] win_smanager_auto (20230125 | Detects win.smanager.)
rule win_smanager_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-01-25"
        version = "1"
        description = "Detects win.smanager."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smanager"
        malpedia_rule_date = "20230124"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c7462cffffffff 7410 6a00 6a00 }
            // n = 4, score = 600
            //   c7462cffffffff       | mov                 dword ptr [esi + 0x28], edi
            //   7410                 | push                ecx
            //   6a00                 | call                eax
            //   6a00                 | add                 esp, 0xc

        $sequence_1 = { 8b4510 85c0 7407 50 ff15???????? 5f }
            // n = 6, score = 600
            //   8b4510               | lea                 eax, [0x1ec]
            //   85c0                 | dec                 eax
            //   7407                 | mov                 dword ptr [ebp - 9], eax
            //   50                   | dec                 eax
            //   ff15????????         |                     
            //   5f                   | mov                 dword ptr [ebp - 1], ebx

        $sequence_2 = { 51 51 ffd0 83c40c c7460800000000 }
            // n = 5, score = 600
            //   51                   | movaps              xmm0, xmmword ptr [ebp - 9]
            //   51                   | dec                 eax
            //   ffd0                 | lea                 ecx, [ebx + 0x10]
            //   83c40c               | inc                 ebp
            //   c7460800000000       | xor                 ecx, ecx

        $sequence_3 = { 85f6 7417 8b0e 85c9 }
            // n = 4, score = 600
            //   85f6                 | push                esi
            //   7417                 | push                0
            //   8b0e                 | push                0
            //   85c9                 | mov                 edi, eax

        $sequence_4 = { 8b7604 6a00 6a00 56 68???????? }
            // n = 5, score = 600
            //   8b7604               | xor                 edx, edx
            //   6a00                 | dec                 eax
            //   6a00                 | sub                 esp, 0x20
            //   56                   | dec                 eax
            //   68????????           |                     

        $sequence_5 = { 83c602 6a22 56 e8???????? 83c408 85c0 }
            // n = 6, score = 600
            //   83c602               | inc                 ebp
            //   6a22                 | xor                 eax, eax
            //   56                   | mov                 edx, dword ptr [edi + 4]
            //   e8????????           |                     
            //   83c408               | call                dword ptr [eax + 8]
            //   85c0                 | mov                 esi, dword ptr [esi + 4]

        $sequence_6 = { 8b4608 85c0 7420 a801 7515 83e0fe }
            // n = 6, score = 600
            //   8b4608               | push                esi
            //   85c0                 | add                 esp, 8
            //   7420                 | test                eax, eax
            //   a801                 | push                2
            //   7515                 | push                ecx
            //   83e0fe               | push                ecx

        $sequence_7 = { 6a00 6a00 ff15???????? 8bf8 897e28 }
            // n = 5, score = 600
            //   6a00                 | mov                 ebx, ecx
            //   6a00                 | dec                 eax
            //   ff15????????         |                     
            //   8bf8                 | lea                 eax, [0x9dfb]
            //   897e28               | dec                 eax

        $sequence_8 = { ff15???????? 32c0 e9???????? 0f1005???????? }
            // n = 4, score = 300
            //   ff15????????         |                     
            //   32c0                 | xor                 al, al
            //   e9????????           |                     
            //   0f1005????????       |                     

        $sequence_9 = { a801 751c 4883e0fe 488d4f08 4c8b08 4d85c9 740c }
            // n = 7, score = 100
            //   a801                 | test                al, 1
            //   751c                 | jne                 0x1e
            //   4883e0fe             | dec                 eax
            //   488d4f08             | and                 eax, 0xfffffffe
            //   4c8b08               | dec                 eax
            //   4d85c9               | lea                 ecx, [edi + 8]
            //   740c                 | dec                 esp

        $sequence_10 = { 0000 80ed4a 0044feff ff900100008c }
            // n = 4, score = 100
            //   0000                 | test                al, 1
            //   80ed4a               | je                  0xb
            //   0044feff             | push                2
            //   ff900100008c         | push                ecx

        $sequence_11 = { 4883ec20 488bd9 e8???????? 488d05fb9d0000 }
            // n = 4, score = 100
            //   4883ec20             | inc                 ebp
            //   488bd9               | xor                 eax, eax
            //   e8????????           |                     
            //   488d05fb9d0000       | dec                 eax

        $sequence_12 = { 0000 8b9534fdffff 83c201 899534fdffff }
            // n = 4, score = 100
            //   0000                 | add                 byte ptr [eax], al
            //   8b9534fdffff         | sub                 ch, 0x4a
            //   83c201               | add                 byte ptr [esi + edi*8 - 1], al
            //   899534fdffff         | call                dword ptr [eax - 0x73ffffff]

        $sequence_13 = { 0001 ce 50 0008 }
            // n = 4, score = 100
            //   0001                 | add                 byte ptr [edi + 0x73], dh
            //   ce                   | add                 byte ptr [eax], al
            //   50                   | mov                 edx, dword ptr [ebp - 0x2cc]
            //   0008                 | add                 edx, 1

        $sequence_14 = { 488d0d95fcffff ff15???????? b902800000 ff15???????? 90 }
            // n = 5, score = 100
            //   488d0d95fcffff       | je                  0xcd
            //   ff15????????         |                     
            //   b902800000           | mov                 word ptr [eax], bp
            //   ff15????????         |                     
            //   90                   | sub                 eax, ebx

        $sequence_15 = { b920000000 e8???????? 488bf8 448b842480000000 33d2 }
            // n = 5, score = 100
            //   b920000000           | lea                 ecx, [0xfffffc95]
            //   e8????????           |                     
            //   488bf8               | mov                 ecx, 0x8002
            //   448b842480000000     | nop                 
            //   33d2                 | je                  0x1e

        $sequence_16 = { 0006 fc 59 008dfd590000 }
            // n = 4, score = 100
            //   0006                 | add                 byte ptr [esi + edi*8], al
            //   fc                   | pop                 ecx
            //   59                   | add                 byte ptr [esi + edi*8 + 0x59], al
            //   008dfd590000         | add                 byte ptr [ecx + 0x59fe], cl

        $sequence_17 = { 488d05ec010000 488945f7 48895dff 0f2845f7 }
            // n = 4, score = 100
            //   488d05ec010000       | mov                 ecx, ebp
            //   488945f7             | inc                 ecx
            //   48895dff             | lea                 edx, [eax + 1]
            //   0f2845f7             | call                eax

        $sequence_18 = { 4885c0 0f84c7000000 668928 2bc3 448bc0 4981f8feffff7f }
            // n = 6, score = 100
            //   4885c0               | mov                 ecx, dword ptr [eax]
            //   0f84c7000000         | dec                 ebp
            //   668928               | test                ecx, ecx
            //   2bc3                 | je                  0xe
            //   448bc0               | dec                 eax
            //   4981f8feffff7f       | test                eax, eax

        $sequence_19 = { 741c 4533c0 488bcd 418d5001 ffd0 }
            // n = 5, score = 100
            //   741c                 | inc                 esp
            //   4533c0               | mov                 eax, eax
            //   488bcd               | dec                 ecx
            //   418d5001             | cmp                 eax, 0x7ffffffe
            //   ffd0                 | dec                 eax

        $sequence_20 = { 0000 0c0c 0c0c 0c0c 0c0c 0c0c 0102 }
            // n = 7, score = 100
            //   0000                 | mov                 esi, dword ptr [esi + 4]
            //   0c0c                 | push                0
            //   0c0c                 | push                0
            //   0c0c                 | push                esi
            //   0c0c                 | mov                 eax, dword ptr [esi + 8]
            //   0c0c                 | test                eax, eax
            //   0102                 | je                  0x24

        $sequence_21 = { 0003 b157 0000 0c0c }
            // n = 4, score = 100
            //   0003                 | add                 byte ptr [ecx], al
            //   b157                 | into                
            //   0000                 | push                eax
            //   0c0c                 | add                 byte ptr [eax], cl

        $sequence_22 = { 0007 b15a 0007 b15a }
            // n = 4, score = 100
            //   0007                 | add                 byte ptr [esi], al
            //   b15a                 | cld                 
            //   0007                 | pop                 ecx
            //   b15a                 | add                 byte ptr [ebp + 0x59fd], cl

        $sequence_23 = { 0004fe 59 0044fe59 0089fe590000 }
            // n = 4, score = 100
            //   0004fe               | add                 byte ptr [ebx], al
            //   59                   | mov                 cl, 0x57
            //   0044fe59             | add                 byte ptr [eax], al
            //   0089fe590000         | or                  al, 0xc

    condition:
        7 of them and filesize < 10013696
}
Download all Yara Rules