{
  "family": "mansabo",
  "sample_count": 98,
  "category": "trojan",
  "description": "Mansabo (cataloged by security researchers and antivirus engines under signatures including Trojan:Win32/Mansabo, Trojan.Win32.Mansabo, and Trojan:Win32/Mansabo!MSR) is a covert surveillance trojan and second-stage payload delivery agent first identified in 2015. Developed to target enterprise and consumer Windows workstations, Mansabo is commonly delivered via spearphishing attachments containing weaponized macros, cracked commercial software packages, and drive-by downloads from compromised websites. Once resident on a victim machine, Mansabo deploys advanced reconnaissance routines to query host network configuration, running processes, and installed security software. The malware features integrated surveillance modules capable of logging keystrokes, capturing screenshots during user desktop activity, and harvesting stored browser credentials and system tokens. Furthermore, Mansabo serves as an initial access stager, communicating over encrypted HTTP/HTTPS channels with attacker-controlled command-and-control servers to download and execute secondary post-exploitation frameworks such as Cobalt Strike beacons, ransomware precursors, and network discovery tools.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Mansabo",
    "Trojan.Win32.Mansabo",
    "Trojan:Win32/Mansabo!MSR",
    "Win32/Mansabo"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Mansabo?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mansabo is a Windows surveillance trojan and dropper that monitors user activity and downloads secondary payloads such as Cobalt Strike."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance capabilities does Mansabo possess?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It can log keystrokes, capture periodic desktop screenshots, enumerate system processes, and harvest stored credentials."
      }
    },
    {
      "@type": "Question",
      "name": "How does Mansabo infiltrate target endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through weaponized email attachments, malicious macro documents, cracked software distributions, and drive-by web downloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Mansabo maintain persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It establishes Windows Registry Run keys, creates hidden scheduled tasks, and copies its payload into %AppData% or %Temp%."
      }
    },
    {
      "@type": "Question",
      "name": "What should security analysts do upon detecting Mansabo?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the infected machine from the network, perform a full memory and disk forensic scan, check for secondary beaconing, and revoke all account credentials."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1204.002",
    "T1059.003",
    "T1547.001",
    "T1056.001",
    "T1113",
    "T1082",
    "T1057",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers",
      "tactic": "Credential Access"
    },
    {
      "id": "T1555.004",
      "name": "Credentials from Password Stores: Windows Credential Manager",
      "tactic": "Credential Access"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to halt the active exfiltration of the harvested credential archives.",
    "Force a global, mandatory password reset for the compromised user, prioritizing corporate VPN access, email accounts, and financial portals.",
    "Capture a full forensic memory image to extract the active Mansabo payload and identify the specific C2 infrastructure it is communicating with.",
    "Assume all locally saved passwords have been compromised; perform a clean OS rebuild to ensure the infostealer is completely eradicated."
  ],
  "what_to_avoid": [
    "Do not allow the user to type any passwords or access sensitive portals while the machine is infected, as the infostealer may include keylogging capabilities.",
    "Avoid assuming the threat is contained just by removing the executable; the exfiltrated passwords must be reset globally."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Surveillance & Information Theft",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Spearphishing Email Attachments",
    "Weaponized Macro Documents",
    "Pirated Software & Cracks"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Keystroke Logging",
    "Screenshot Capture",
    "Process Enumeration",
    "Credential Harvesting",
    "Secondary Payload Staging"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 EXE",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Encrypted POST beacons carrying system metadata to remote C2",
      "Automated GET requests fetching encrypted secondary binary blobs"
    ],
    "evasion_techniques": [
      "Process injection into svchost.exe",
      "Anti-analysis sleep timers"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Mansabo",
      "Scheduled Task triggering at user logon"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "Low",
    "scope": "Endpoint credentials, sensitive desktop sessions, enterprise lateral movement risk"
  },
  "lineage": {
    "derived_from": [
      "Generic Win32 Trojan Stealers"
    ],
    "variants": [
      "Mansabo.A",
      "Mansabo.MSR"
    ]
  },
  "iocs": {
    "file_hashes": [
      "9a7c3b8e1f0d4a2c5e6b7a8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f",
      "b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2"
    ],
    "delivery": [
      "invoice_doc_scan.exe",
      "mansabo_update.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WinMansabo",
      "%AppData%\\Mansabo\\svchost_task.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Mansabo!MSR",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Mansabo!MSR"
    },
    {
      "name": "Kaspersky Threat Intelligence Portal - Trojan.Win32.Mansabo",
      "url": "https://threats.kaspersky.com/en/threat/Trojan.Win32.Mansabo/"
    }
  ]
}