Procedure examples

LunarWeb can receive C2 commands hidden in the structure of .jpg and .gif images.

LunarWeb can use shell commands to discover network adapters and configuration.

The LunarWeb install files have been encrypted with AES-256.

LunarWeb can split exfiltrated data that exceeds 1.33 MB in size into multiple random sized parts between 384 and 512 KB.

LunarWeb can collect user information from the targeted host.

LunarWeb can use WMI queries for discovery on the victim host.

LunarWeb can enumerate system network connections.

LunarWeb has used shell commands to list running processes.

LunarWeb has the ability to run shell commands via PowerShell.

LunarWeb can run shell commands using a BAT file with a name matching `%TEMP%\<⁠random_9_alnum_chars>.batfile` or through cmd.exe with the `/c` and `/U` option for Unicode output.

LunarWeb can discover local group memberships.

LunarWeb can self-delete from a compromised host if safety checks of C2 connectivity fail.

LunarWeb can use `POST` to send victim identification to C2 and `GET` to retrieve commands.

LunarWeb can use WMI queries and shell commands such as systeminfo.exe to collect the operating system, BIOS version, and domain name of the targeted system.

LunarWeb has the ability to retrieve directory listings.

LunarWeb has the ability to use a HTTP proxy server for C&C communications.

LunarWeb can use one C2 URL for first contact and to upload information about the host computer and two additional C2 URLs for getting commands.

LunarWeb can use Base64 encoding to obfuscate C2 commands.

LunarWeb can identify shared resources in compromised environments.

LunarWeb can decrypt strings related to communication configuration using RC4 with a static key.

LunarWeb can pause for a number of hours before entering its C2 communication loop.

LunarWeb can list installed software on compromised systems.

LunarWeb has run shell commands to obtain a list of installed security products.

LunarWeb can retrieve output from arbitrary processes and shell commands via a pipe.

LunarWeb can create a ZIP archive with specified files and directories.

LunarWeb can zlib-compress data prior to exfiltration.

LunarWeb can run a custom binary protocol under HTTPS for C2.

LunarWeb can send AES encrypted C2 commands.

LunarWeb can send short C2 commands, up to 512 bytes, encrypted with RSA-4096.

LunarWeb can capture information on group policy settings