Manjusaka: A Chinese sibling of Sliver and Cobalt Strike

The malware implant is a RAT family called “Manjusaka.” The C2 is an ELF binary written in GoLang, while the implants are written in the Rust programming language, consisting of a variety of capabilities that can be used to control the infected endpoint, including executing arbitrary commands.
Analysts discovered EXE and ELF versions of the implant.
Both sets of samples catering to these platforms consist of almost the same set of RAT functionalities and communication mechanisms.

Communications
The sample makes HTTP requests to a fixed address http[:]//39[.]104[.]90[.]45/global/favicon.png that contains a fixed session cookie defined by the sample rather than by the server. The session cookie in the HTTP requests is base64 encoded and contains a compressed copy of binary data representing a combination of random bytes and system preliminary information used to fingerprint and register the infected endpoint with the C2.

The information on the cookie is arranged as described in the table below before it is compressed and encoded into base64.
The communication follows a regular pattern of communication, the implant will make a request to an URL which in this case is ‘/global/favicon.png’

Even though the request is an HTTP GET, it sends two bytes that are 0x191a as data. The reply is always the same, consisting of five bytes 0x1a1a6e0429. This is the C2 standard reply, which does not correspond to any kind of action on the implant.

If the session cookie is not provided, the server will reply with a 302 code redirecting to http[:]//micsoft[.]com which is also redirected, this time with a 301, to http[:]//wwwmicsoft[.]com. At the time of publishing, the redirection seems like a trick to distract researchers. Talos could not find any direct correlation between the domains and the authors and/or operators of this C2.

The implant can perform the following functions on the infected endpoint based on the request and accompanying data received from the C2 server:

-Execute arbitrary commands: The implant can run arbitrary commands on the system using “cmd.exe /c”.
-Get file information for a specified file: Creation and last write times, size, volume serial number and file index.
-Get information about the current network connections (TCP and UDP) established on the system, including Local network addresses, remote addresses and owning Process IDs (PIDs).
-Collect browser credentials: Specifically for Chromium-based browsers using the query: SELECT signon_realm, username_value, password_value FROM logins ; Browsers targeted: Google Chrome, Chrome Beta, Microsoft Edge, 360 (Qihoo), QQ Browser (Tencent), Opera, Brave and Vivaldi.
-Collect Wi-Fi SSID information, including passwords using the command: netsh wlan show profile key=clear
-Obtain Premiumsoft Navicat credentials: Navicat is a graphical database management utility that can connect to a variety of DB types such as MySQL, Mongo, Oracle, SQLite, PostgreSQL, etc. The implant enumerates through the installed software’s registry keys for each configured DB server and obtains the values representing the Port, UserName, Password (Pwd).
-Take screenshots of the current desktop.
-Obtain comprehensive system information from the endpoint, including:
*System memory global information.
*Processor power information.
*Current and critical temperature readings from WMI using “SELECT * FROM MSAcpi_ThermalZoneTemperature”
*Information on the network interfaces connected to the system: Names
*Process and System times: User time, exit time, creation time, kernel time.
*Process module names.
*Disk and drive information: Volume serial number, name, root path name and disk free space.
*Network account names, local groups.
*Windows build and major version numbers.
-Activate the file management module to carry out file-related activities.