BianLian

Resource Development — T1587.001 — Develop Capabilities: Malware

Initial Access — T1078 — Valid Accounts; BianLian leverages compromised RDP credentials.

Initial Access — T1133 — External Remote Services

Initial Access — T1566 — Phishing

Execution — T1053.005 — Scheduled Task/Job: Scheduled Task

ussd : Module used to run USSD codes and make calls

Execution — T1059.001 — Command and Scripting Interpreter: PowerShell

Execution — T1059.003 — Command and Scripting Interpreter: Windows Command Shell

The malware uses the multidex scheme to load the payload as secondary DEX... The technique consists in re-writing the way applications load multiple DEX.

Execution — T1053.005 — Scheduled Task/Job: Scheduled Task

Initial Access — T1078 — Valid Accounts; BianLian leverages compromised RDP credentials.

Persistence — T1098 — Account Manipulation

Defence Evasion — T1112 — Modify Registry

Initial Access — T1133 — External Remote Services

Persistence — T1136.001 — Create Account: Local Account

the first thing the application does is hide its icon and constantly requests permission to abuse Accessibility services functionalities until granted. Once these are obtained, it initiates all of its modules.

Execution — T1053.005 — Scheduled Task/Job: Scheduled Task

Initial Access — T1078 — Valid Accounts; BianLian leverages compromised RDP credentials.

Persistence — T1098 — Account Manipulation

the first thing the application does is hide its icon and constantly requests permission to abuse Accessibility services functionalities until granted. Once these are obtained, it initiates all of its modules.

At a first look, it seemed clear that the APK was heavily obfuscated... It seems to mostly rely on generating a variety of random functions to hide the real functionalities of the sample... Most of the strings in the code are generated by using functions implementing a XOR decryption of byte arrays.

Initial Access — T1078 — Valid Accounts; BianLian leverages compromised RDP credentials.

the first thing the application does is hide its icon

This code is loaded and used by the main application through Java reflection.

Defence Evasion — T1112 — Modify Registry

Credential Access — T1003.001 — OS Credential Dumping: LSASS Memory

Credential Access — T1003.003 — OS Credential Dumping: NTDS

injects : Module used to run overlay attacks, mostly on banking applications

Credential Access — T1552.001 — Credentials In Files

Discovery — T1012 — Query Registry

Discovery — T1018 — Remote System Discovery

Discovery — T1033 — System Owner User Discovery

Discovery — T1046 — Network Service Discovery

Discovery — T1069.002 — Permission Group Discovery: Domain Groups

Discovery — T1083 — File and Directory Discovery

Discovery — T1087.002 — Account Discovery: Domain Account

Discovery — T1135 — Network Share Discovery

Discovery — T1482 — Domain Trust Discovery

Lateral Movement — T1021.001 — Remote Services: Remote Desktop Protocol; BianLian consistently uses compromised RDP credentials for initial access and lateral movement.

injects : Module used to run overlay attacks, mostly on banking applications

The Screencast Module allows the malware to record the screen of the device... to create a virtual display to screencast.

Collection — T1115 — Clipboard Data

The BianLian sample installs fine on Android 8. The (fake) server BianLian communicates to a C&C via HTTP. | BianLian communicates to a C&C via HTTP.

This module is used to create a functioning SSH server on the device using JSCH... BianLian can setup a proxy that can run SSH sessions using remote port forwarding on port 34500, with an implementation similar to 2017’s malware MilkyDoor, making communication with the CC harder to detect.

Command and Control — T1105 — Ingress Tool Transfer

Command and Control — T1219 — Remote Access Software

most of the interesting calls, like information exfiltration and connection initiations, are executed from the code in the first application.

Exfiltration — T1048 — Exfiltration Over Alternative Protocol

Exfiltration — T1537 — Transfer Data to Cloud Account

Exfiltration — T1567.002 — Exfiltration Over Web Service: Exfiltration to Cloud Storage

Impact — T1486 — Data Encrypted for Impact; BianLian stopped encrypting victim data after January 2023 and shifted to data-exfiltration-only extortion.

Cl0p campaigns quietly exfiltrate data for weeks, then publicly extort victims. Everest, BianLian, Medusa, INC Ransom, and Rhysida use stolen data and leak-site publication as extortion leverage.

Defence Evasion — T1562.001 — Impair Defences: Disable or Modify Tools

Defence Evasion — T1562.004 — Impair Defences: Disable or Modify System Firewall