Procedure examples

LunarMail can parse IDAT chunks from .png files to look for zlib-compressed and AES encrypted C2 commands.

LunarMail has used RC4 and AES to encrypt strings and its exfiltration configuration respectively.

LunarMail can use email image attachments with embedded data for receiving C2 commands and data exfiltration.

LunarMail has been installed using a VBA macro.

LunarMail can delete the previously used staging directory and files on subsequent rounds of exfiltration and replace it with a new one.

LunarMail can set the `PR_DELETE_AFTER_SUBMIT` flag to delete messages sent for data exfiltration.

LunarMail can communicates with C2 using email messages via the Outlook Messaging API (MAPI).

LunarMail can create a directory in `%TEMP%\` to stage data prior to exfilration.

LunarMail can capture environmental variables on compromised hosts.

LunarMail can search its staging directory for output files it has produced.

LunarMail can ping a specific C2 URL with the ID of a victim machine in the subdomain.

LunarMail can capture screenshots from compromised hosts.

LunarMail can capture the recipients of sent email messages from compromised accounts.

LunarMail has the ability to use Outlook add-ins for persistence.

LunarMail can decrypt strings to retrieve configuration settings.

LunarMail has been installed through a malicious macro in a Microsoft Word document.

LunarMail can create an arbitrary process with a specified command line and redirect its output to a staging directory.