TmangerMalware
- luckyback
Last reported 5 years ago, by Group-IB1 report
ATT&CK techniques
1 technique · each with the sentence it comes from- T1497.001System Checks
“In case of success, the system checks for batch files in the “/test” directory of “Yandex.Disk” (PROFIND).”
What the reports say
1 report, newest first · the exact sentence from each-
The Art of Cyberwarfare“Group-IB specialists wanted to make sure that Mail-O is loader, while Smanager and Tmanger are Remote Access Trojans (RAT).”
Indicators in its reports
named in the reports above- c9e03855f738e360…142c7ae6c2ecin 1 report
- 6857bb2c3ae5f9c2…e7a10cb5573fin 1 report
- 6303cce6747703e8…3ba7db26ea4bin 1 report
- 2fe6af7ce84cb96a…7ba67591a11ein 1 report
- bc708acdf6b8b605…e375cb3ffeb4in 1 report
- 08645d079abe05b8…b1ec035035cain 1 report
- ae57d779aac235e9…77a099b148abin 1 report
- hxxp://45.32.188[.]226/0000/1301/0024/4u/i7fr09bGus+Wyt7iyjos=in 1 report
- 45.32.188[.]226in 1 report
- hxxp://go.vegispaceshop[.]org/home/2252/0108/IKNYF6oSkYtpU60GfnS27fbRKdcvCj/kZgeNi/in 1 report
- go.vegispaceshop[.]orgin 1 report
- 3ff73686244ca128…024e37e7b86din 1 report
- 209.250.239[.]96in 1 report
- 664fb7cda349da4d36afa7a15f7f14f5in 1 report
- 7874c9ab2828bc3b…a5311147ebb6in 1 report
- 5155c03a2064d80cef6a86a84d67c1b4in 1 report
- 849e6ed87188de6d…649784abdf77in 1 report
- aa9771e98f25db395c7d9f5beb9e5421in 1 report
- 95ac5cc14f114461…13e34a46103din 1 report
- ceb80ceffc82f10acdbe9841e4588eb2in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.