Alien

Category: banking_trojan · Aliases: Trojan:Win32/Alien, Backdoor:Win32/Alien, Win32/Alien, Trojan.Alien, AlienBot, Alien Android Trojan, Trojan-Banker.AndroidOS.Alien · Sample count (EMBER 2018): 19 · Enrichment: curated_sourced · Updated: 2026-10-16
Category: Banking_TrojanStatus: Automated SignaturePlatform: ANDROIDStage: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Collection, Command And Control🕸 Explore Relationship Graph⚙ API JSON⚡ Sigma Rule💾 YARA RuleOS: Android
Executive Summary
Alien (tracked across threat intelligence as AlienBot, Alien Android Banking Trojan, and Trojan:Android/Alien) is a formidable Android banking trojan that emerged in early 2020 as an enhanced successor to the leaked Cerberus banking trojan source code.

Table of Contents

Overview

Alien (tracked across threat intelligence as AlienBot, Alien Android Banking Trojan, and Trojan:Android/Alien) is a formidable Android banking trojan that emerged in early 2020 as an enhanced successor to the leaked Cerberus banking trojan source code. Following the public leak of the Cerberus v2 codebase in August 2020, threat actors adopted and significantly overhauled the framework, marketing Alien as a premier Malware-as-a-Service (MaaS) subscription on Russian-language underground cybercrime forums. Alien is engineered to attack over 226 financial institutions, mobile banking applications, cryptocurrency exchanges, and social media platforms across North America, Europe, and the Asia-Pacific region. Distributed primarily through rogue SMS phishing (smishing) lures and malicious APK droppers hosted on spoofed update portals, Alien aggressively co-opts the Android Accessibility Service (AccessibilityService). Once granted accessibility rights by the victim, Alien automatically assigns itself Device Administrator privileges, silently disables Google Play Protect, grants itself extensive SMS/Call permissions, and blocks user attempts to access device settings to uninstall the malicious application. Alien's core capability is an advanced dynamic webview overlay attack engine: it monitors running foreground packages, and whenever a targeted banking or crypto app is opened, it instantly renders an indistinguishable HTML phishing overlay on top of the legitimate UI to capture banking credentials and credit card information. Uniquely, Alien integrates a customized TeamViewer remote-access module, allowing operators to assume real-time interactive remote control over the mobile device. The trojan intercepts incoming SMS verification codes, steals Google Authenticator 2FA tokens, harvests contacts, and communicates with redundant C2 servers utilizing encrypted HTTP endpoints with Telegram bot channels as a resilient fallback.

Known aliases

Threat reports may refer to this family under multiple names:

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Derived From / Upstream Ancestry: Cerberus

Known Derivatives & Downstream Variants: Alien_Bot · Alien_V1 · Alien_V2_Teamviewer

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1404 · T1411 · T1418 · T1437 · T1636 · T1430

→ Explore the complete 226-Technique ATT&CK Threat Matrix

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

D3FEND IDCountermeasure NameTacticCountered ATT&CKDefensive Guidance
D3-DNSADNS Query AnalysisDetectT1404Monitor DNS queries from non-interactive system services and enforce secure encrypted DNS over TLS (DoT) egress policies.
D3-SCASegmented Cloud Storage AccessIsolateT1636Enforce strict IAM service account policies and VPC Service Controls to prevent staging of sensitive data to unapproved cloud buckets.

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

Delivery vectors

Persistence mechanisms

SIEM / EDR Ingestion: Need these reference indicators for threat hunting?

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

Tier 1 Primitive Artifact Rule (Fast Triage)

Matches raw strings and file markers. Vulnerable to binary repacking and simple obfuscation.

rule MALWARE_WIN_ALIEN_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Alien"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "alien" ascii wide nocase
        $s2 = "trojan:win32/alien" ascii wide nocase
        $s3 = "backdoor:win32/alien" ascii wide nocase
        $s4 = "win32/alien" ascii wide nocase
        $s5 = "trojan.alien" ascii wide nocase
        $s6 = "alienbot" ascii wide nocase
        $s7 = "alien android trojan" ascii wide nocase
        $s8 = "trojan-banker.androidos.alien" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Tier 2 Behavioral Context Rule (Process Chains & Sigma)

Tracks parent-child process anomalies and suspicious scripting telemetry. Resilient against file renames.

title: SystemHelpDesk Detection - Alien (Banking Trojan) Execution & Triage
id: 718bc494-4904-5a0c-9070-0f8a7285a95f
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Alien malware family. Detects recon staging, certutil file payload staging,
  and web-inject process proxying characteristic of banking trojan initial loaders.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/alien
- https://malware-families-catalog.systemhelpdesk.com/defensive/banking-trojan-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.banking-trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1404
- attack.t1411
- attack.t1418
- attack.t1437
- attack.t1636
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \svchost.exe
    - \explorer.exe
    - \msiexec.exe
    - \certutil.exe
    CommandLine|contains:
    - -urlcache
    - -split -f
    - ipconfig /all
    - route print
    - netstat -ano
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: high

Tier 3 Attribution Fingerprint Rule (High Fidelity)

Deep signature matching distinctive operational fingerprints and payload characteristics.

rule MALWARE_WIN_ALIEN_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Alien tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "alien" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}
SOC & SIEM Rule Downloads: ⬇ Download YARA Rule (.yar) ⬇ Download Sigma Rule (YAML) ⬇ Download Sigma Rule (JSON) ⚙ Threat Profile API (JSON)

References & External Analysis

Frequently Asked Questions

What is the origin of the Alien Android banking trojan?

Alien emerged in early 2020 and is built directly on top of the leaked source code of Cerberus v2. Cybercriminals revamped the command infrastructure, enhanced evasive capabilities, and marketed Alien as a Malware-as-a-Service platform.

How does Alien execute overlay attacks on banking apps?

Alien monitors active foreground packages via Android accessibility APIs. When the victim launches a targeted banking or cryptocurrency application, Alien injects a fullscreen WebView overlay displaying a fraudulent login prompt that exfiltrates entered credentials.

How does Alien achieve remote control of an infected Android phone?

Alien incorporates a modified TeamViewer remote administration module. This grants the attacker real-time screen viewing and interactive touch control over the infected phone, enabling them to execute fraudulent financial transfers directly from the device.

How does Alien bypass multi-factor authentication (MFA)?

Alien intercepts incoming SMS verification codes and scrapes dynamic two-factor codes generated by the Google Authenticator app using its accessibility service permissions, streaming them instantly to the operator.

What resilient C2 mechanisms does Alien implement?

Alien utilizes primary HTTP/HTTPS REST endpoints and maintains Telegram bot channels as dynamic fallback communication nodes to receive backup command-and-control server configurations if primary nodes are taken down.

How can Android users protect themselves against Alien malware?

Never download APK applications from untrusted SMS links or third-party web portals, never grant Android Accessibility Service permissions to unverified applications, and maintain active Google Play Protect verification.

How does Alien Android banking trojan abuse Android Accessibility Services to automate 2FA token theft and screen overlays?

Alien repeatedly prompts the user to grant Android Accessibility Service permissions under the guise of an essential update. Once granted, Alien monitors active foreground applications. When the victim opens a supported banking, cryptocurrency, or social media app, Alien automatically displays a pixel-perfect fake login overlay, logs every keystroke, intercepts Google Authenticator 2FA tokens, and prevents the user from accessing device administration settings to uninstall the app.

What relationship exists between Alien's source code lineage and legacy Cerberus Android banking malware?

Alien represents an evolved branch of the infamous Cerberus Android banking Trojan. Following internal disputes among Cerberus developers and the subsequent public leak of the Cerberus v2 source code on underground Russian forums in mid-2020, Alien's author branched the codebase, adding new bypasses for Android 10/11 security restrictions, an integrated TeamViewer remote desktop module, and expanded support for over 220 international banking applications.

What are the main symptoms of a Alien infection?

Symptoms of Alien can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.

Protect Your Network Against Banking_Trojans

Want to prevent Alien and similar threats from compromising your organization? Read our comprehensive defensive guide: Banking Trojan Protection for Businesses.

📣 Threat Intel Correction or Update?

Notice an outdated IOC, unlisted alias, or disputed attribution? Threat researchers are invited to propose an update on GitHub or contact the SystemHelpDesk research desk. All community revisions are credited in our public CHANGELOG.

Need help with an active incident? Published by the SystemHelpdesk threat intelligence team.

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/alien.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.