SManagerMalware
- phantomnet
Last reported 3 years ago, by Elastic Security Labs2 reports
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1005Data from Local System
“Data from Local System”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information”
- T1041Exfiltration Over C2 Channel
“Exfiltration Over C2 Channel”
- T1055Process Injection
“Shortly after being executed, Elastic Defend registered a process injection alert.”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter”
- T1497.001System Checks
“In case of success, the system checks for batch files in the “/test” directory of “Yandex.Disk” (PROFIND).”
What the reports say
2 reports, newest first · the exact sentence from each-
Introducing the REF5961 intrusion set“… sample shares a plugin architecture, and code similarities, and aligns with the victimology described in the publicly reported malware SManager/PhantomNet.”
-
The Art of Cyberwarfare“The experts wrote that Mail-O is a version of the relatively well-known malware called SManager, which is used by the Chinese hacker group TA428.”
Indicators in its reports
named in the reports above- decoded.avast[.]ioin 1 report
- hxxp://president[.]mn/en/ebooksheets.phpin 1 report
- president[.]mnin 1 report
- www.president[.]mnin 1 report
- datacenter.gov[.]mnin 1 report
- hxxps://intranet.gov[.]mn/upload.phpin 1 report
- intranet.gov[.]mnin 1 report
- 45.90.58[.]103in 1 report
- 185.195.237[.]123in 1 report
- 185.82.217[.]164in 1 report
- 195.123.245[.]79in 1 report
- paper.hosted-by-bay[.]netin 1 report
- news.hosted-by-bay[.]netin 1 report
- hosted-by-bay[.]netin 1 report
- 45.133.194[.]106in 1 report
- paypal.goodspaypal[.]comin 1 report
- d218680140ad2c6e…41c02d889a59in 1 report
- redacted[.]mnin 1 report
- shop.redacted[.]mnin 1 report
- 192.123.245[.]79in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.