Malware.View on attack.mitre.org
LunarMail is a backdoor that has been used by Turla since at least 2020 including in a compromise of a European ministry of foreign affairs (MFA) in conjunction with LunarLoader and LunarWeb. LunarMail is designed to be deployed on workstations and can use email messages and Steganography in command and control.
| Technique | Procedure example |
|---|---|
| T1001.002 Steganography |
LunarMail can parse IDAT chunks from .png files to look for zlib-compressed and AES encrypted C2 commands. |
| T1027.013 Encrypted/Encoded File |
LunarMail has used RC4 and AES to encrypt strings and its exfiltration configuration respectively. |
| T1041 Exfiltration Over C2 Channel |
LunarMail can use email image attachments with embedded data for receiving C2 commands and data exfiltration. |
| T1059.005 Visual Basic |
LunarMail has been installed using a VBA macro. |
| T1070.004 File Deletion |
LunarMail can delete the previously used staging directory and files on subsequent rounds of exfiltration and replace it with a new one. |
| T1070.008 Clear Mailbox Data |
LunarMail can set the `PR_DELETE_AFTER_SUBMIT` flag to delete messages sent for data exfiltration. |
| T1071.003 Mail Protocols |
LunarMail can communicates with C2 using email messages via the Outlook Messaging API (MAPI). |
| T1074.001 Local Data Staging |
LunarMail can create a directory in `%TEMP%\` to stage data prior to exfilration. |
| T1082 System Information Discovery |
LunarMail can capture environmental variables on compromised hosts. |
| T1083 File and Directory Discovery |
LunarMail can search its staging directory for output files it has produced. |
| T1095 Non-Application Layer Protocol |
LunarMail can ping a specific C2 URL with the ID of a victim machine in the subdomain. |
| T1113 Screen Capture |
LunarMail can capture screenshots from compromised hosts. |
| T1114.001 Local Email Collection |
LunarMail can capture the recipients of sent email messages from compromised accounts. |
| T1137.006 Add-ins |
LunarMail has the ability to use Outlook add-ins for persistence. |
| T1140 Deobfuscate/Decode Files or Information |
LunarMail can decrypt strings to retrieve configuration settings. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
