ESET LightNeuron May 2019

LightNeuron is controlled via commands that are embedded into PDFs and JPGs using steganographic methods.

LightNeuron can collect files from a local system.

LightNeuron gathers information about network adapters using the Win32 API call GetAdaptersInfo.

LightNeuron can be configured to automatically exfiltrate files under a specified directory.

LightNeuron encrypts its configuration files with AES-256.

LightNeuron can be configured to exfiltrate data during nighttime or working hours.

LightNeuron has used filenames associated with Exchange and Outlook for binary and configuration files, such as winmail.dat.

LightNeuron exfiltrates data over its email C2 channel.

LightNeuron is capable of executing commands via cmd.exe.

LightNeuron has a function to delete files.

LightNeuron uses SMTP for C2.

LightNeuron can store email data in files and directories specified in its configuration, such as C:\Windows\ServiceProfiles\NetworkService\appdata\Local\Temp\.

LightNeuron gathers the victim computer name using the Win32 API call GetComputerName.

LightNeuron has the ability to download and execute additional files.

LightNeuron is capable of starting a process using CreateProcess.

LightNeuron collects Exchange emails matching rules specified in its configuration.

LightNeuron can be configured to automatically collect files under a specified directory.

LightNeuron has used AES and XOR to decrypt configuration files and commands.

LightNeuron has used a malicious Microsoft Exchange transport agent for persistence.

LightNeuron contains a function to encrypt and store emails that it collects.

LightNeuron is capable of modifying email content, headers, and attachments during transit.

LightNeuron uses AES to encrypt C2 traffic.