LunarLoader

Malware & Tools · LunarLoader

· MalwareS1143 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

LunarLoader is the loader component for the LunarWeb and LunarMail backdoors that has been used by Turla since at least 2020 including against a European ministry of foreign affairs (MFA). LunarLoader has been observed as a standalone and as a part of trojanized open-source software such as AdmPwd.(Citation: ESET Turla Lunar toolset May 2024)

Tactic Coverage

stealth (3)discovery (1)persistence (1)

Used By (1 groups)

G0010TurlaIRON HUNTER, Group 88

Techniques (5)

T1016System Network Configuration Discovery

discovery

T1137.006Add-ins

persistence

T1140Deobfuscate/Decode Files or Information

stealth

T1480Execution Guardrails

stealth

T1620Reflective Code Loading

stealth

References

https://attack.mitre.org/software/S1143 https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/