Manjusaka
MITRE ATT&CK: S1156 View on attack.mitre.org
Aliases: Manjusaka
- First seen
- 2022-01-01 00:00:00
- Malware type
- rat
- Family
- Malware family
- Operating systems
- linux, windows
- Profile updated
- 2026-07-07 15:31:47
Targeted industries: government-and-public-sector technology-and-telecommunications financial-services
Context
Manjusaka is a Chinese-language intrusion framework, similar to Sliver and Cobalt Strike, with an ELF binary written in GoLang as the controller for Windows and Linux implants written in Rust. First identified in 2022, Manjusaka consists of multiple components, only one of which (a command and control module) is freely available.
Detection coverage
- 5 YARA rules
- 150 Sigma rules
Malware & tools used
- System Information Discovery (attack-pattern)
- Credentials from Password Stores (attack-pattern)
- System Network Configuration Discovery (attack-pattern)
- Credentials from Web Browsers (attack-pattern)
- Exfiltration Over C2 Channel (attack-pattern)
- Windows Command Shell (attack-pattern)
- File and Directory Discovery (attack-pattern)
- Screen Capture (attack-pattern)
- Standard Encoding (attack-pattern)
- Web Protocols (attack-pattern)
Detection rules
- AVASTTI_Manjusaka_Framework_Go_Build_Id (yara-rule)
- AVASTTI_Manjusaka_Payload_Encoded_Hexstring (yara-rule)
- AVASTTI_Manjusaka_Payload_Elf (yara-rule)
- SEKOIA_Manjusaka_Samples (yara-rule)
- MALPEDIA_Win_Manjusaka_Auto (yara-rule)
Reports & references
- MITRE ATT&CK — S1156 (report)
- Cisco Talos — Manjusaka Offensive Framework (report)