Alien

Webshells are often used during data breaches. For example, an attacker can find the password of MySQL in phpMyAdmin/config.inc.php

once clicked, redirected the targets to a rogue domain that dropped the exploits before taking the victim to an authentic site

all the three campaigns in question commenced with a spear-phishing email that contained one-time links mimicking URL shortener services

exec ( 'tasklist /NH /FO CSV' , $outputLines );

The 0-day exploits were used alongside n-day exploits... to target Android users

the user is forced to update the app in order to continue using the app... the user will be prompted to download and install it.

Webshells are often used during data breaches. For example, an attacker can find the password of MySQL in phpMyAdmin/config.inc.php

“A Pipeline provides the addValve() method for adding Valves to the request-processing pipeline.” | “Use reflection to locate the interceptor list within RequestMappingHandlerMapping... Inject the malicious Interceptor at the beginning (index 0) of adaptedInterceptors.” | “With a memory shell, an attacker can perform a fileless attack by injecting a new webshell into a server... while leaving no corresponding file on disk.” | “The payload creates a new Filter instance... calls standardContext.addFilterDef() and standardContext.addFilterMapBefore() to insert the malicious FilterDef into the beginning of the Filter chain.” | “A Java memory shell... use[s] reflection to dynamically load components and register malicious components into the container’s internal data structures.”

The code of the Google Authenticator 2FA stealer of the Alien Trojan is visible in following snippet: public final void sniffAuthenticator ( AccessibilityService serv , AccessibilityEvent event , String currPackage )

compromise the system by injecting malicious code into privileged processes

leveraging it to drop a second exploit to escalate privileges and deploy the backdoor

Webshells are often used during data breaches. For example, an attacker can find the password of MySQL in phpMyAdmin/config.inc.php

The code of the Google Authenticator 2FA stealer of the Alien Trojan is visible in following snippet: public final void sniffAuthenticator ( AccessibilityService serv , AccessibilityEvent event , String currPackage )

After successfully downloading the “update”, the user will be asked for the permission to install apps from unknown sources.

involved an exploit chain using CVE-2021-37973 and CVE-2021-37976 to escape the Chrome sandbox

If you are concerned about WAFs and IDSs, you can enable Event Horizon for evasion.

These apps posed as QR code scanners, PDF scanners, and cryptocurrency apps.

compromise the system by injecting malicious code into privileged processes

Webshells are often used during data breaches. For example, an attacker can find the password of MySQL in phpMyAdmin/config.inc.php

we found that it was signed with a legitimate certificate named SCANDI LLC ... Uncompressing the MSI file unveiled several files ... The first request that the binary sends is: hxxps://datasmetrics.]com/files/Loader_TM.dll

The complete list of features of Alien is as follows: ... Self-protection: Emulation-detection

the configuration contains filter rules based on device model. Based on the models being filtered out and the code of the dropper, we can draw a conclusion that this is done to avoid downloading the payload on emulators or research environment.

is engineered to record audio, add CA certificates, and hide apps to evade detection

Languages such as PHP and Classic ASP execute payloads through eval() , while Java and .NET rely on reflective loading.

is engineered to record audio, add CA certificates, and hide apps to evade detection

To facilitate successful credentials interception, the bad actors use a so called "Webinjects" - customized modules or packages used in malware that typically inject HTML or JavaScript code into content before it's rendered on a web browser. As a result, webinjects can alter what the user sees on his/her browser... malware developers design code to intercept victims credentials using such approach

It has common capabilities such as overlay attacks, control and steal SMS messages and harvest the contact list. It can leverage its keylogger for any use and therefore broaden the attack scope further than its target list.

Most importantly, it offers a notifications sniffer, allowing it to get the content of all notifications on the infected device

The complete list of features of Alien is as follows: ... Contact list collection

exec ( 'tasklist /NH /FO CSV' , $outputLines ); ... The core idea is to obtain all running processes from the remote server and compare them against a database of known anti-virus software.

The complete list of features of Alien is as follows: ... Device info collection

The complete list of features of Alien is as follows: ... Self-protection: Emulation-detection

the configuration contains filter rules based on device model. Based on the models being filtered out and the code of the dropper, we can draw a conclusion that this is done to avoid downloading the payload on emulators or research environment.

The complete list of features of Alien is as follows: ... Application listing

The complete list of features of Alien is as follows: ... Location collection

Alien also provides a virtual terminal. Users can use this feature to establish SSH connections to other machines.

Users can use this feature to establish SSH connections to other machines.

To facilitate successful credentials interception, the bad actors use a so called "Webinjects" - customized modules or packages used in malware that typically inject HTML or JavaScript code into content before it's rendered on a web browser. As a result, webinjects can alter what the user sees on his/her browser... malware developers design code to intercept victims credentials using such approach

It has common capabilities such as overlay attacks, control and steal SMS messages and harvest the contact list. It can leverage its keylogger for any use and therefore broaden the attack scope further than its target list.

is engineered to record audio

webinjects can alter what the user sees on his/her browser, as opposed to what's in fact being sent by the server... the webinject will interpret an identical design of legitimate pages from popular services.

The dropper makes a request towards the C2 sending information about the device, including device ID, device name, locale, country, Android SDK version.

In those newly found samples the authors revisited the C2 communication protocol

meaning that the threat actors can perform the fraud from the victim’s device.

Using Alien’s built-in SOCKS5 proxy, external tools such as sqlmap can access internal web applications through the compromised server.

the attackers first installed the Android Alien banking trojan with RAT functionality used to load the Predator Android implant

the newly found samples included the RAT feature, making use of TeamViewer to provide remote access to the infected device.

The complete list of features of Alien is as follows: ... Self-protection: Preventing removal