Essential information

Value / Name

84141bec33a157a8fd1c6a55fcec337785a44607

Confidence

100/100

Revoked

Yes

Valid from

05/04/2023 15:41

Valid until

08/07/2024 15:41

Pattern type

yara

Published

20/12/2025 19:39

Modified

21/12/2025 00:23

Author / Source

AlienVault

Description

Pattern

rule UNK_APT_Alien_Implant {   
       meta:   
           author = "Exatrack"   
           date =   "2023-03-03"   
           update =   "2023-03-03"   
           description = "Detects an unknown implant from AlienManager family, maybe related to melofee"   
           tlp =  "CLEAR"   
           sample_hash = "3535f45bbfafda863665c41d97d894c39277dfd9af1079581d28015f76669b88,"   
      
       strings:   
           $str_alien_01 = "[+]  Connect %s Successed,Start Transfer..."   
           $str_alien_02 = "Alloc buffer to decrypt data error, length == %d."   
           $str_alien_03 = "pel_decrypt_msg data error, error"   
           $str_alien_04 = "encrypt data error, length == %d."   
           $str_alien_05 = "DoRecvOverlapInternal error!"   
           $str_alien_06 = "Socks Listen port is %d,Username is %s, password is %s"   
           $str_alien_07 = "Start port mapping error! remoteAddr=%s remotePort=%d localAddr=%s localPort=%d"   
           $str_alien_08 = "OnCmdSocksStart error!"   
           $str_alien_09 = "The master isn't readable!"   
           $str_alien_10 = "ConnectBypassSocks proxy:%s:%d error!"   
           $str_alien_11 = "ConnectBypassSocks to %s %d"   
           $str_alien_12 = "now datetime: %d-%d-%d %d:%d:%d"   
           $str_alien_13 = "Not during working hours! Disconnect!"   
           $str_alien_14 = "Example: ./AlienReverse --reverse-address=192.168.1.101:80 --reverse-password=123456"   
           $str_alien_15 = "Not during working hours! Disconnect!"   
           $str_alien_16 = "SocksManager.cpp"   
           $str_alien_17 = "connect() in app_connect"   
           $str_alien_18 = "They send us %hhX %hhX"   
           $str_alien_19 = "your input directory is not exist!"   
           $str_alien_20 = "Send data to local error ==> %d.\n"   
      
       condition:   
           any of them   
   }

Labels / Tags

Labels: linux mélofée rootkit winnti

Marking (TLP)

TLP:CLEAR