LunarMail
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1071 | .003 | Application Layer Protocol: Mail Protocols |
LunarMail can communicates with C2 using email messages via the Outlook Messaging API (MAPI).(Citation: ESET Turla Lunar toolset May 2024) |
| Enterprise | T1059 | .005 | Command and Scripting Interpreter: Visual Basic |
LunarMail has been installed using a VBA macro.(Citation: ESET Turla Lunar toolset May 2024) |
| Enterprise | T1001 | .002 | Data Obfuscation: Steganography |
LunarMail can parse IDAT chunks from .png files to look for zlib-compressed and AES encrypted C2 commands.(Citation: ESET Turla Lunar toolset May 2024) |
| Enterprise | T1074 | .001 | Data Staged: Local Data Staging |
LunarMail can create a directory in `%TEMP%\` to stage data prior to exfilration.(Citation: ESET Turla Lunar toolset May 2024) |
| Enterprise | T1114 | .001 | Email Collection: Local Email Collection |
LunarMail can capture the recipients of sent email messages from compromised accounts.(Citation: ESET Turla Lunar toolset May 2024) |
| Enterprise | T1070 | .004 | Indicator Removal: File Deletion |
LunarMail can delete the previously used staging directory and files on subsequent rounds of exfiltration and replace it with a new one.(Citation: ESET Turla Lunar toolset May 2024) |
| .008 | Indicator Removal: Clear Mailbox Data |
LunarMail can set the `PR_DELETE_AFTER_SUBMIT` flag to delete messages sent for data exfiltration.(Citation: ESET Turla Lunar toolset May 2024) |
||
| Enterprise | T1027 | .013 | Obfuscated Files or Information: Encrypted/Encoded File |
LunarMail has used RC4 and AES to encrypt strings and its exfiltration configuration respectively.(Citation: ESET Turla Lunar toolset May 2024) |
| Enterprise | T1137 | .006 | Office Application Startup: Add-ins |
LunarMail has the ability to use Outlook add-ins for persistence.(Citation: ESET Turla Lunar toolset May 2024) |
| Enterprise | T1204 | .002 | User Execution: Malicious File |
LunarMail has been installed through a malicious macro in a Microsoft Word document.(Citation: ESET Turla Lunar toolset May 2024) |
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.