LunarLoader
- ID
- S1143
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 28 Jun 2024
LunarLoader is the loader component for the LunarWeb and LunarMail backdoors that has been used by Turla since at least 2020 including against a European ministry of foreign affairs (MFA). LunarLoader has been observed as a standalone and as a part of trojanized open-source software such as AdmPwd.[1]
Techniques used (5)
- T1016 System Network Configuration Discovery
- T1137.006 Add-ins
- T1140 Deobfuscate/Decode Files or Information
- T1480 Execution Guardrails
- T1620 Reflective Code Loading