SYMBOLCOMMON_NAMEaka. SYNONYMS
win.smanager (Back to overview)

SManager

aka: PhantomNet

There is no description at this point.

References
2021-09-03Trend MicroMohamad Mokbel
@techreport{mokbel:20210903:state:df86499, author = {Mohamad Mokbel}, title = {{The State of SSL/TLS Certificate Usage in Malware C&C Communications}}, date = {2021-09-03}, institution = {Trend Micro}, url = {https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf}, language = {English}, urldate = {2021-09-19} } The State of SSL/TLS Certificate Usage in Malware C&C Communications
AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader
2021-08-03Group-IBAnastasia Tikhonova, Dmitry Kupin
@online{tikhonova:20210803:art:d715071, author = {Anastasia Tikhonova and Dmitry Kupin}, title = {{The Art of Cyberwarfare Chinese APTs attack Russia}}, date = {2021-08-03}, organization = {Group-IB}, url = {https://blog.group-ib.com/task}, language = {English}, urldate = {2021-08-06} } The Art of Cyberwarfare Chinese APTs attack Russia
Albaniiutas Mail-O SManager TA428
2021-06-08SentinelOneJuan Andrés Guerrero-Saade
@online{guerrerosaade:20210608:thundercats:8eac3cd, author = {Juan Andrés Guerrero-Saade}, title = {{ThunderCats Hack the FSB | Your Taxes Didn’t Pay For This Op}}, date = {2021-06-08}, organization = {SentinelOne}, url = {https://labs.sentinelone.com/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op/}, language = {English}, urldate = {2021-06-09} } ThunderCats Hack the FSB | Your Taxes Didn’t Pay For This Op
Mail-O SManager Tmanger
2021-02-19Medium 0xthreatintel0xthreatintel
@online{0xthreatintel:20210219:how:5fed055, author = {0xthreatintel}, title = {{How to unpack SManager APT tool?}}, date = {2021-02-19}, organization = {Medium 0xthreatintel}, url = {https://0xthreatintel.medium.com/how-to-unpack-smanager-apt-tool-cb5909819214}, language = {English}, urldate = {2021-02-20} } How to unpack SManager APT tool?
SManager
2021-02-17VinCSSTrương Quốc Ngân
@online{ngn:20210217:re020:76db05d, author = {Trương Quốc Ngân}, title = {{[RE020] ElephantRAT (Kunming version): our latest discovered RAT of Panda and the similarities with recently Smanager RAT}}, date = {2021-02-17}, organization = {VinCSS}, url = {https://blog.vincss.net/2021/02/re020-elephantrat-kunming-version-our-latest-discovered-RAT-of-Panda.html}, language = {English}, urldate = {2021-02-20} } [RE020] ElephantRAT (Kunming version): our latest discovered RAT of Panda and the similarities with recently Smanager RAT
SManager
2021-01-26Medium 0xthreatintel0xthreatintel
@online{0xthreatintel:20210126:reversing:716c09c, author = {0xthreatintel}, title = {{Reversing APT Tool : SManager (Unpacked)}}, date = {2021-01-26}, organization = {Medium 0xthreatintel}, url = {https://0xthreatintel.medium.com/reversing-apt-tool-smanager-unpacked-d413a04961c4}, language = {English}, urldate = {2021-01-27} } Reversing APT Tool : SManager (Unpacked)
SManager
2020-12-25VinCSSTrương Quốc Ngân
@online{ngn:20201225:re0182:4a2ca92, author = {Trương Quốc Ngân}, title = {{[RE018-2] Analyzing new malware of China Panda hacker group used to attack supply chain against Vietnam Government Certification Authority - Part 2}}, date = {2020-12-25}, organization = {VinCSS}, url = {https://blog.vincss.net/2020/12/re018-2-analyzing-new-malware-of-china-panda-hacker-group-used-to-attack-supply-chain-against-vietnam-government-certification-authority.html?m=1}, language = {English}, urldate = {2020-12-26} } [RE018-2] Analyzing new malware of China Panda hacker group used to attack supply chain against Vietnam Government Certification Authority - Part 2
SManager
2020-12-19VinCSSTrương Quốc Ngân
@online{ngn:20201219:re0181:bd0904c, author = {Trương Quốc Ngân}, title = {{[RE018-1] Analyzing new malware of China Panda hacker group used to attack supply chain against Vietnam Government Certification Authority - Part 1}}, date = {2020-12-19}, organization = {VinCSS}, url = {https://blog.vincss.net/2020/12/re018-1-analyzing-new-malware-of-china-panda-hacker-group-used-to-attack-supply-chain-against-vietnam-government-certification-authority.html}, language = {English}, urldate = {2020-12-23} } [RE018-1] Analyzing new malware of China Panda hacker group used to attack supply chain against Vietnam Government Certification Authority - Part 1
SManager
2020-12-19VinCSSTrương Quốc Ngân
@online{ngn:20201219:re0172:c0a6b21, author = {Trương Quốc Ngân}, title = {{[RE017-2] Phân tích kỹ thuật dòng mã độc mới được sử dụng để tấn công chuỗi cung ứng nhắm vào Ban Cơ yếu Chính phủ Việt Nam của nhóm tin tặc Panda Trung Quốc (Phần 2)}}, date = {2020-12-19}, organization = {VinCSS}, url = {https://blog.vincss.net/2020/12/re017-2-phan-tich-ky-thuat-dong-ma-doc-moi-co-nhieu-dau-hieu-lien-quan-toi-nhom-tin-tac-Panda.html}, language = {English}, urldate = {2020-12-19} } [RE017-2] Phân tích kỹ thuật dòng mã độc mới được sử dụng để tấn công chuỗi cung ứng nhắm vào Ban Cơ yếu Chính phủ Việt Nam của nhóm tin tặc Panda Trung Quốc (Phần 2)
SManager
2020-12-17ESET ResearchIgnacio Sanmillan, Matthieu Faou
@online{sanmillan:20201217:operation:6822847, author = {Ignacio Sanmillan and Matthieu Faou}, title = {{Operation SignSight: Supply‑chain attack against a certification authority in Southeast Asia}}, date = {2020-12-17}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2020/12/17/operation-signsight-supply-chain-attack-southeast-asia/}, language = {English}, urldate = {2020-12-18} } Operation SignSight: Supply‑chain attack against a certification authority in Southeast Asia
SManager
2020-12-17VinCSSVinCSS
@online{vincss:20201217:re0171:a4d3525, author = {VinCSS}, title = {{[RE017-1] Phân tích kỹ thuật dòng mã độc mới được sử dụng để tấn công chuỗi cung ứng nhắm vào Ban Cơ yếu Chính phủ Việt Nam của nhóm tin tặc Panda Trung Quốc (Phần 1)}}, date = {2020-12-17}, organization = {VinCSS}, url = {https://blog.vincss.net/2020/12/phan-tich-ky-thuat-dong-ma-doc-moi-co-nhieu-dau-hieu-lien-quan-toi-nhom-tin-tac-Panda.html}, language = {Vietnamese}, urldate = {2020-12-19} } [RE017-1] Phân tích kỹ thuật dòng mã độc mới được sử dụng để tấn công chuỗi cung ứng nhắm vào Ban Cơ yếu Chính phủ Việt Nam của nhóm tin tặc Panda Trung Quốc (Phần 1)
SManager
2020-12-11NTT SecurityHiroki Hada
@online{hada:20201211:pandas:b182e4e, author = {Hiroki Hada}, title = {{Panda’s New Arsenal: Part 3 Smanager}}, date = {2020-12-11}, organization = {NTT Security}, url = {https://insight-jp.nttsecurity.com/post/102glv5/pandas-new-arsenal-part-3-smanager}, language = {Japanese}, urldate = {2021-01-01} } Panda’s New Arsenal: Part 3 Smanager
FunnyDream SManager Tmanger
Yara Rules
[TLP:WHITE] win_smanager_auto (20221125 | Detects win.smanager.)
rule win_smanager_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-11-21"
        version = "1"
        description = "Detects win.smanager."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smanager"
        malpedia_rule_date = "20221118"
        malpedia_hash = "e0702e2e6d1d00da65c8a29a4ebacd0a4c59e1af"
        malpedia_version = "20221125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 51 ffd0 83c40c c7460800000000 }
            // n = 4, score = 600
            //   51                   | lea                 edx, [0xa98f]
            //   ffd0                 | dec                 eax
            //   83c40c               | mov                 ecx, ebx
            //   c7460800000000       | dec                 eax

        $sequence_1 = { 8b4608 85c0 7420 a801 7515 }
            // n = 5, score = 600
            //   8b4608               | add                 esp, 0xc
            //   85c0                 | mov                 dword ptr [esi + 8], 0
            //   7420                 | push                esi
            //   a801                 | push                0
            //   7515                 | push                0

        $sequence_2 = { 740e 3d45270000 7407 3d46270000 }
            // n = 4, score = 600
            //   740e                 | push                0
            //   3d45270000           | push                0
            //   7407                 | push                esi
            //   3d46270000           | je                  0x12

        $sequence_3 = { 85f6 7417 8b0e 85c9 }
            // n = 4, score = 600
            //   85f6                 | dec                 eax
            //   7417                 | add                 ecx, 0x50
            //   8b0e                 | mov                 edx, 0x20
            //   85c9                 | inc                 esp

        $sequence_4 = { 8b4510 85c0 7407 50 }
            // n = 4, score = 600
            //   8b4510               | push                ecx
            //   85c0                 | push                ecx
            //   7407                 | call                eax
            //   50                   | add                 esp, 0xc

        $sequence_5 = { 8b7604 6a00 6a00 56 }
            // n = 4, score = 600
            //   8b7604               | dec                 eax
            //   6a00                 | mov                 ecx, dword ptr [edi + 8]
            //   6a00                 | dec                 esp
            //   56                   | lea                 eax, [esi + 0xf0]

        $sequence_6 = { 7410 6a00 6a00 6830001100 }
            // n = 4, score = 600
            //   7410                 | mov                 ecx, eax
            //   6a00                 | dec                 eax
            //   6a00                 | mov                 ebx, eax
            //   6830001100           | dec                 eax

        $sequence_7 = { 56 68???????? 6a00 6a00 ff15???????? 8bf8 897e28 }
            // n = 7, score = 600
            //   56                   | mov                 ecx, dword ptr [ebx + 0x30]
            //   68????????           |                     
            //   6a00                 | dec                 eax
            //   6a00                 | mov                 dword ptr [ebx + 0x30], 0
            //   ff15????????         |                     
            //   8bf8                 | mov                 esi, dword ptr [esi + 4]
            //   897e28               | push                0

        $sequence_8 = { ff15???????? 32c0 e9???????? 0f1005???????? }
            // n = 4, score = 300
            //   ff15????????         |                     
            //   32c0                 | xor                 al, al
            //   e9????????           |                     
            //   0f1005????????       |                     

        $sequence_9 = { 0007 b15a 0007 b15a }
            // n = 4, score = 100
            //   0007                 | add                 eax, dword ptr [ecx]
            //   b15a                 | add                 byte ptr [esi], al
            //   0007                 | cld                 
            //   b15a                 | pop                 ecx

        $sequence_10 = { 750a ff15???????? 33c0 eb5a ba06000000 4c8d4c2430 c644243001 }
            // n = 7, score = 100
            //   750a                 | inc                 ecx
            //   ff15????????         |                     
            //   33c0                 | mov                 dword ptr [esi], eax
            //   eb5a                 | lea                 eax, [edi + 1]
            //   ba06000000           | jmp                 0x7f
            //   4c8d4c2430           | mov                 ebx, 1
            //   c644243001           | dec                 esp

        $sequence_11 = { 0000 8b9534fdffff 83c201 899534fdffff }
            // n = 4, score = 100
            //   0000                 | add                 dword ptr [edx], eax
            //   8b9534fdffff         | add                 byte ptr [eax], al
            //   83c201               | sub                 ch, 0x4a
            //   899534fdffff         | add                 byte ptr [esi + edi*8 - 1], al

        $sequence_12 = { 0000 80ed4a 0044feff ff900100008c }
            // n = 4, score = 100
            //   0000                 | mov                 edi, eax
            //   80ed4a               | mov                 dword ptr [esi + 0x28], edi
            //   0044feff             | push                0
            //   ff900100008c         | push                0

        $sequence_13 = { 48c7431000000000 c60300 83c8ff e9???????? }
            // n = 4, score = 100
            //   48c7431000000000     | dec                 eax
            //   c60300               | mov                 dword ptr [ebx + 0x10], 0
            //   83c8ff               | mov                 byte ptr [ebx], 0
            //   e9????????           |                     

        $sequence_14 = { c7473002000000 488b4f08 4c8d86f0000000 4883c150 ba20000000 448bca }
            // n = 6, score = 100
            //   c7473002000000       | mov                 ecx, eax
            //   488b4f08             | jmp                 0x77
            //   4c8d86f0000000       | dec                 eax
            //   4883c150             | mov                 ecx, dword ptr [ecx + 8]
            //   ba20000000           | jmp                 0x6d
            //   448bca               | jne                 0xc

        $sequence_15 = { 0004fe 59 0044fe59 0089fe590000 }
            // n = 4, score = 100
            //   0004fe               | add                 byte ptr [edi], cl
            //   59                   | add                 byte ptr [ebx], al
            //   0044fe59             | mov                 cl, 0x57
            //   0089fe590000         | add                 byte ptr [eax], al

        $sequence_16 = { 4c8bc8 e8???????? eb72 488b4908 e8???????? eb67 }
            // n = 6, score = 100
            //   4c8bc8               | mov                 eax, dword ptr [eax + 0x18]
            //   e8????????           |                     
            //   eb72                 | dec                 eax
            //   488b4908             | mov                 ecx, dword ptr [eax]
            //   e8????????           |                     
            //   eb67                 | mov                 eax, dword ptr [ecx]

        $sequence_17 = { 488b4018 488b08 8b01 418906 8d4701 eb72 bb01000000 }
            // n = 7, score = 100
            //   488b4018             | dec                 eax
            //   488b08               | lea                 eax, [ebp + 0x70]
            //   8b01                 | dec                 eax
            //   418906               | mov                 dword ptr [esp + 0x20], eax
            //   8d4701               | dec                 esp
            //   eb72                 | lea                 ecx, [esp + 0x30]
            //   bb01000000           | dec                 eax

        $sequence_18 = { 488d1592a90000 488bc8 488bd8 ff15???????? 488d158fa90000 488bcb }
            // n = 6, score = 100
            //   488d1592a90000       | xor                 eax, eax
            //   488bc8               | jmp                 0x5e
            //   488bd8               | mov                 edx, 6
            //   ff15????????         |                     
            //   488d158fa90000       | dec                 esp
            //   488bcb               | lea                 ecx, [esp + 0x30]

        $sequence_19 = { 0006 fc 59 008dfd590000 }
            // n = 4, score = 100
            //   0006                 | or                  al, 0xc
            //   fc                   | add                 byte ptr [esi + edi*8], al
            //   59                   | pop                 ecx
            //   008dfd590000         | add                 byte ptr [esi + edi*8 + 0x59], al

        $sequence_20 = { 0003 b157 0000 0c0c }
            // n = 4, score = 100
            //   0003                 | push                eax
            //   b157                 | add                 byte ptr [ecx], al
            //   0000                 | into                
            //   0c0c                 | push                eax

        $sequence_21 = { e8???????? 488d442434 4889442428 488d4570 4889442420 4c8d4c2430 }
            // n = 6, score = 100
            //   e8????????           |                     
            //   488d442434           | or                  eax, 0xffffffff
            //   4889442428           | dec                 eax
            //   488d4570             | lea                 eax, [esp + 0x34]
            //   4889442420           | dec                 eax
            //   4c8d4c2430           | mov                 dword ptr [esp + 0x28], eax

        $sequence_22 = { 0001 ce 50 0008 }
            // n = 4, score = 100
            //   0001                 | dec                 edx
            //   ce                   | add                 byte ptr [edi + 0x73], dh
            //   50                   | add                 byte ptr [eax], al
            //   0008                 | mov                 edx, dword ptr [ebp - 0x2cc]

        $sequence_23 = { 0000 0c0c 0c0c 0c0c 0c0c 0c0c 0102 }
            // n = 7, score = 100
            //   0000                 | je                  0x24
            //   0c0c                 | test                al, 1
            //   0c0c                 | jne                 0x1d
            //   0c0c                 | push                0xd
            //   0c0c                 | add                 esp, 4
            //   0c0c                 | mov                 esi, eax
            //   0102                 | push                0

    condition:
        7 of them and filesize < 10013696
}
Download all Yara Rules