Alfa3

The kit filename says alfa3.php. The binary says Alfa Shell V4 “Tesla” family: the same gzinflate+base64+create_function obfuscation, the same Hmei7 mail() beacon, the same hardcoded default account (username admin, password stored as an unsalted MD5 in the plaintext config header). It is not a byte-identical copy of alfav4-tesla.php, though — alfa3.php is 6f13fa5a… / 252 KB while alfav4-tesla.php is 85d88d15… / 167 KB. They are two distinct packed builds of the same family. The “alfa3” naming is a packaging artifact, not a separate webshell family.

The Naming Deception

This is significant for defenders and analysts who track webshell families by filename. An operator deploying alfa3.php from a kit may believe they are running an older, simpler Alfa variant. They are not. They are running the full V4 Tesla payload — including the author surveillance beacon that reports every compromised host back to the kit author’s Yandex mailbox. The filename mismatch creates a false sense of inventory control: the operator thinks they know what they deployed, but the payload does not match the label.

Author Surveillance Beacon

Every authenticated page load triggers an eval(base64_decode(...)) chain that resolves to a mail() call to a hardcoded Yandex address controlled by the Hmei7 group (Indonesian). The operator harvests victims. The kit author harvests operators. The alfa3.php filename adds a layer: operators who search for “alfa3 vulnerabilities” will not find the V4 Tesla analysis, missing the beacon entirely.

Capabilities

Full-featured file manager, database browser, command execution, CGI backdoor installer, FTP brute-force, mass defacement, network scanner. Default account: username admin hardcoded, password ehsan stored as an unsalted MD5 (a6f452ec3293d7fb72c5b677257b20ec = md5(“ehsan”)) in the plaintext config header — exposed for offline cracking. Session-based auth returns HTTP 403 to unauthenticated requests — scanner-resistant, but the credential hash is exposed regardless.

Vulnerabilities

Detection Surface

File-system indicators

HTTP access-log indicators

YARA rule

import "hash"

rule webshell_alfa_v4_tesla {
    meta:
        description = "Alfa Shell V4 Tesla (anchors on Alfa-specific markers; the shared Hmei7 beacon is covered by webshell_hmei7_beacon)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/alfa-v4-tesla/"
        status      = "validated"
        sha256_alfa3        = "6f13fa5a8e42bfdd127f17410bde002872de149b47e9153fb5b36ba007341306"
        sha256_alfav4_tesla = "85d88d15687c7a98941143f370ea61a98bf73248df2369000f02aefe8443fd90"

    strings:
        $alfa_title    = "Alfa Shell" ascii nocase
        $alfa_team     = "Alfa_Team" ascii
        $solevisible   = "solevisible" ascii
        $config_global = "$GLOBALS['OWtTcBmdOd']" ascii
        $tujan_mail    = "$tujuanmail" ascii
        $pesan_alert   = "$pesan_alert" ascii
        $create_fn     = "create_function" ascii
        $eval_b64      = "eval(base64_decode(" ascii

    condition:
        filesize < 300KB
        and (
            // source-form shell: an Alfa marker together with a PHP code marker
            // (the AND excludes Alfa readme/notes .txt that merely name the shell)
            (($alfa_title or $alfa_team or $solevisible or ($tujan_mail and $pesan_alert))
                and ($create_fn or $eval_b64))
            // alfa3 packed instance — unique obfuscated global
            or $config_global
            // opaque packed instances — no usable plaintext signature, hash-anchored
            // (filesize == guard so the SHA256 is computed only for the exact candidate)
            or (filesize == 252175 and hash.sha256(0, filesize) == "6f13fa5a8e42bfdd127f17410bde002872de149b47e9153fb5b36ba007341306")
            or (filesize == 167465 and hash.sha256(0, filesize) == "85d88d15687c7a98941143f370ea61a98bf73248df2369000f02aefe8443fd90")
        )
}

This rule is shared with Alfa V4 Tesla — alfa3 and alfav4-tesla are distinct files (different hash and size) detected by the same behavioral rule.

This rule requires libyara built with the hash module (standard / OpenSSL-enabled) for the hash-anchored packed variants.

The Hmei7 supply-chain beacon is detected by the generic webshell_hmei7_beacon rule — see Hmei7 beacon detection .

MITRE ATT&CK

OHIIHO Threat Research.