ESET Turla Lunar toolset May 2024

LunarWeb can receive C2 commands hidden in the structure of .jpg and .gif images.

LunarMail can parse IDAT chunks from .png files to look for zlib-compressed and AES encrypted C2 commands.

LunarWeb can use shell commands to discover network adapters and configuration.

LunarLoader can verify the targeted host's DNS name which is then used in the creation of a decyrption key.

LunarMail has used RC4 and AES to encrypt strings and its exfiltration configuration respectively.

The LunarWeb install files have been encrypted with AES-256.

LunarWeb can split exfiltrated data that exceeds 1.33 MB in size into multiple random sized parts between 384 and 512 KB.

LunarWeb can collect user information from the targeted host.

Turla has named components of LunarWeb to mimic Zabbix agent logs.

LunarMail can use email image attachments with embedded data for receiving C2 commands and data exfiltration.

LunarWeb can use WMI queries for discovery on the victim host.

LunarWeb can enumerate system network connections.

LunarWeb has used shell commands to list running processes.

LunarWeb has the ability to run shell commands via PowerShell.

LunarWeb can run shell commands using a BAT file with a name matching `%TEMP%\<⁠random_9_alnum_chars>.batfile` or through cmd.exe with the `/c` and `/U` option for Unicode output.

LunarMail has been installed using a VBA macro.

LunarWeb can discover local group memberships.

LunarMail can delete the previously used staging directory and files on subsequent rounds of exfiltration and replace it with a new one.

LunarWeb can self-delete from a compromised host if safety checks of C2 connectivity fail.

LunarMail can set the `PR_DELETE_AFTER_SUBMIT` flag to delete messages sent for data exfiltration.

LunarWeb can use `POST` to send victim identification to C2 and `GET` to retrieve commands.

LunarMail can communicates with C2 using email messages via the Outlook Messaging API (MAPI).

LunarMail can create a directory in `%TEMP%\` to stage data prior to exfilration.

LunarMail can capture environmental variables on compromised hosts.

LunarWeb can use WMI queries and shell commands such as systeminfo.exe to collect the operating system, BIOS version, and domain name of the targeted system.

LunarMail can search its staging directory for output files it has produced.

LunarWeb has the ability to retrieve directory listings.

LunarWeb has the ability to use a HTTP proxy server for C&C communications.

LunarMail can ping a specific C2 URL with the ID of a victim machine in the subdomain.

LunarWeb can use one C2 URL for first contact and to upload information about the host computer and two additional C2 URLs for getting commands.

LunarMail can capture screenshots from compromised hosts.

LunarMail can capture the recipients of sent email messages from compromised accounts.

LunarWeb can use Base64 encoding to obfuscate C2 commands.

LunarWeb can identify shared resources in compromised environments.

LunarMail has the ability to use Outlook add-ins for persistence.

LunarLoader has the ability to use Microsoft Outlook add-ins to establish persistence.

LunarLoader can deobfuscate files containing the next stages in the infection chain.

LunarWeb can decrypt strings related to communication configuration using RC4 with a static key.

LunarMail can decrypt strings to retrieve configuration settings.

LunarMail has been installed through a malicious macro in a Microsoft Word document.

LunarLoader can use the DNS domain name of a compromised host to create a decryption key to ensure a malicious payload can only execute against the intended targets.

LunarWeb can pause for a number of hours before entering its C2 communication loop.

LunarWeb can list installed software on compromised systems.

LunarWeb has run shell commands to obtain a list of installed security products.

LunarMail can create an arbitrary process with a specified command line and redirect its output to a staging directory.

A Turla Javascript backdoor added a local_update_check value under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence. Additionally, a Turla custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence.

LunarWeb can retrieve output from arbitrary processes and shell commands via a pipe.

LunarWeb can create a ZIP archive with specified files and directories.

LunarWeb can zlib-compress data prior to exfiltration.

Turla has placed LunarWeb install files into directories that are excluded from scanning.