ZPHP/SmartApeSG Malware Traffic Analysis

Read at “https://jenkins96.github.io/2025-06-19-SmartApeSG-Network-Analysis/”

Fake Browser Update Analysis — SmartApeSG

ZPHP/SmartApeSG is a malware campaign that uses fake browser updates on legitimate sites to trick users into downloading and installing a Remote Access Trojan (RAT).

It uses Net Support Manager software tool as a RAT, allowing remote control to adversaries.

NetSupport Manager is a legitimate tool for remote desktop control.

• NetSupport Manager

Infection Process

• High level:

1. User visits a compromise website.
2. Website displays a message saying that the Browser’s version is out of date and must be updated.
3. User clicks the button to download the update.
4. User gets infected by RAT.

Keep reading at “https://jenkins96.github.io/2025-06-19-SmartApeSG-Network-Analysis/”