malware

LunarLoader S1143

Type: malware
Platform: Windows
Created: 27 June 2024
Last modified: 27 June 2024

LunarLoader is the loader component for the LunarWeb and LunarMail backdoors that has been used by Turla since at least 2020 including against a European ministry of foreign affairs (MFA). LunarLoader has been observed as a standalone and as a part of trojanized open-source software such as AdmPwd.[1]

TechniquesBottom 23%

TacticsBottom 21%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S1143

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
Splunk	The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Deobfuscate/Decode Files or Information	-	medium	Michael Haag, Splunk	2021-03-25	2026-10-02	bfe94226-8c10-11eb-a4b3-acde48001122
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
Splunk	This analytic identifies non-browser processes reaching out to public IP lookup or geolocation servi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Reconnaissance Gather Victim Network Information IP Addresses Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali, Splunk, Janantha Marasinghe	2025-07-01	2026-09-22	568cb83e-d79e-4a23-85ec-6e1f6c30cb2f
	Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. (...)	Generic	test	ps_script	windows	PowerShell	Persistence Office Application Startup Add-ins	-	high	frack113	2021-12-28	—	36fbec91-fa1b-4d5d-8df1-8d8edcb632ad
	Detects when a user enables DNS-over-HTTPS. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Persistence, Defense Impairment Modify Registry	-	medium	Austin Songer	2021-07-22	2023-08-17	04b45a8a-d11d-49e4-9acc-4a1b524407a5
	Adversaries may look for details about the network configuration and settings of systems they access (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Network Configuration Discovery	-	low	frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'	2021-12-07	2025-10-18	0e4164da-94bc-450d-a7be-a4b176179f1f
Splunk	This detection identifies when an AI command-line tool is launched in an unsafe mode that bypasses normal safety checks and user approvals. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Stealth Execution Guardrails	-	medium	Teoderick Contreras, Splunk	2022-01-10	2026-05-13	737e8baa-d44e-4fa9-8281-24056ed424c0
Splunk	The following analytic detects suspicious Base64 decode operations that may indicate malicious activity, such as data exfiltration or execution of encoded commands. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Stealth Deobfuscate/Decode Files or Information	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	5890ba10-4e48-4dc0-8a40-3e1ebe75e737
Splunk	The following analytic detects suspicious system network configuration discovery activities, which may indicate an adversary's attempt to gather information about the network environment. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery System Network Configuration Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-10-02	5db16825-81bd-4923-a8d6-d6a13a59832a
	Detects suspicious process command line that uses base64 encoded input for execution with a shell	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	pH-T (Nextron Systems)	2022-07-26	2023-06-16	ba592c6d-6888-43c3-b8c6-689b8fe47337
	Detects the presence of a base64 version of the shebang in the commandline, which could indicate a m (...)	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-09-15	—	fe2f9663-41cb-47e2-b954-8a228f3b9dff
	Detects suspicious process command line that starts with a shell that executes something and finally (...)	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	Florian Roth (Nextron Systems)	2022-03-14	2022-07-26	880973f3-9708-491c-a77b-2a35a1921158
Splunk	The following analytic identifies potential enumeration of local network configuration on Linux systems. (...)	Anomaly	stable	process_creation	linux	Sysmon · Osquery	Discovery System Network Configuration Discovery	-	medium	Teoderick Contreras, Splunk	2022-02-14	2026-10-02	535cb214-8b47-11ec-a2c7-acde48001122
	Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.	Hunting	test	ps_module	windows	PowerShell	Discovery Software Discovery Security Software Discovery Discovery System Network Configuration Discovery	-	low	Christopher Peacock @SecurePeacock, SCYTHE @scythe_io	2023-07-13	—	ea207a23-b441-4a17-9f76-ad5be47d51d3
Splunk	This analytic detects attempts to enumerate or verify the configuration of the macOS application firewall. (...)	Anomaly	stable	process_creation	-	Osquery	Discovery System Network Configuration Discovery	-	medium	Jamie Windley, Splunk	2026-04-15	2026-10-02	f8db6e0b-55bb-40ca-bc85-2b3700adb0f8
	Detects execution of mshta.exe with file types that looks like they do not typically represent HTA ( (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter JavaScript Stealth Deobfuscate/Decode Files or Information Stealth System Binary Proxy Execution Mshta	CVE-2020-1599	high	Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems)	2019-02-22	2025-05-12	cc7abbd0-762b-41e3-8a26-57ad50d2eea3
	Detects nltest commands that can be used for information discovery	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery Remote System Discovery Discovery System Network Configuration Discovery	-	low	Arun Chauhan	2023-02-03	—	903076ff-f442-475a-b667-4f246bcc203b
	Detects instances where an SNMP service on an OpenCanary node has had an OID request.	Generic	test	-	-	OpenCanary	Lateral Movement Remote Services Discovery System Network Configuration Discovery	-	high	Security Onion Solutions	2024-03-08	—	e9856028-fd4e-46e6-b3d1-10f7ceb95078
	Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. (...)	Generic	test	process_creation	macos	-	Execution Command and Scripting Interpreter Stealth Deobfuscate/Decode Files or Information Execution User Execution	-	medium	Tim Rauch (rule), Elastic (idea)	2022-10-17	—	234dc5df-40b5-49d1-bf53-0d44ce778eca
	Detects a ping command that uses a hex encoded IP address	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2018-03-23	2025-10-17	1a0d4aba-7668-4365-9ce4-6d79ab088dfd
	Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. (...)	Generic	test	process_creation	macos	-	Stealth Deobfuscate/Decode Files or Information	-	high	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-12-20	—	09a910bf-f71f-4737-9c40-88880ba5913d
	Detects command line patterns used by BlackByte ransomware in different operations	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Impact Data Destruction Stealth Deobfuscate/Decode Files or Information Impact Network Denial of Service	-	high	Florian Roth (Nextron Systems)	2022-02-25	2023-02-08	999e8307-a775-4d5f-addc-4855632335be
	Detects potential commandline obfuscation using known escape characters	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information	-	medium	juju4	2018-12-11	2023-03-03	f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd
	Detects usage of "Reflection.Assembly" load functions to dynamically load assemblies in memory	Generic	test	ps_script	windows	PowerShell	Stealth Reflective Code Loading	-	medium	frack113	2022-12-25	—	ddcd88cb-7f62-4ce5-86f9-1704190feb0a
	Detects network enumeration performed on AWS.	Unsupported	unsupported	cloud_audit	-	AWS CloudTrail · AWS	Discovery System Network Configuration Discovery	-	low	Janantha Marasinghe	2022-12-13	2023-03-24	c3d53999-4b14-4ddd-9d9b-e618c366b54d
	Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence Office Application Startup Add-ins	-	high	frack113	2023-01-15	2023-08-17	961e33d1-4f86-4fcf-80ab-930a708b2f82
	Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).	Generic	test	file_event	windows	Sysmon	Persistence Office Application Startup Add-ins	-	high	NVISO	2020-05-11	2023-02-08	8e1cb247-6cf6-42fa-b440-3f27d57e9936
	Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence Office Application Startup Add-ins	-	medium	Bhabesh Raj	2021-01-10	2026-01-09	9d15044a-7cfe-4d23-8085-6ebc11df7685
	Detects system discovery activity carried out by Pikabot, such as incl. (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery	-	high	Andreas Braathen (mnemonic.io)	2023-10-27	2024-01-26	698d4431-514f-4c82-af4d-cf573872a9f5
	Detects nltest commands that can be used for information discovery	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery System Network Configuration Discovery	-	medium	Craig Young, oscd.community, Georg Lauenstein	2021-07-24	2023-12-15	5cc90652-4cbd-4241-aa3b-4b462fa5a248
Splunk	The following analytic identifies the rapid execution of processes used for system network configuration discovery on an endpoint. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Network Configuration Discovery	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	3f0b95e3-3195-46ac-bea3-84fb59e7fac5	-
	Detects usage of WinAPI functions in PowerShell scripts. (...)	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Execution Native API Stealth Reflective Code Loading	-	high	Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community	2020-10-06	2026-04-29	03d83090-8cba-44a0-b02f-0b756a050306
	Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information	-	high	Florian Roth (Nextron Systems)	2019-08-24	2023-04-06	fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c
	Detects base64 encoded .NET reflective loading of Assembly	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information Stealth Reflective Code Loading	-	high	Christian Burkard (Nextron Systems), pH-T (Nextron Systems)	2022-03-01	2023-01-30	62b7ccc9-23b4-471e-aa15-6da3663c4d59
	A General detection for specific decompress commands in PowerShell logs. (...)	Generic	test	ps_module	windows	PowerShell	Stealth Deobfuscate/Decode Files or Information	-	informational	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-05-02	2022-12-25	1ddc1472-8e52-4f7d-9f11-eab14fc171f5
Splunk	The following analytic detects PowerShell Script Block Logging (Event ID 4104) evidence of a complete P/Invoke process-injection API chain at either the compile phase or the execution phase. (...)	Generic	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Privilege Escalation, Stealth Process Injection Dynamic-link Library Injection Thread Execution Hijacking Asynchronous Procedure Call Process Hollowing Stealth Reflective Code Loading	-	medium	Teoderick Contreras, Splunk	2026-04-29	2026-06-25	3f1a2b4c-d5e6-7890-abcd-ef1234567890
	Detects Silence downloader. (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Discovery Process Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Owner/User Discovery	-	high	Alina Stepchenkova, Roman Rezvukhin, Group-IB, oscd.community	2019-11-01	2023-02-24	170901d1-de11-4de7-bccb-8fa13678d857	-
	Detects suspicious rules that delete or move messages or folders are set on a user's inbox.	Generic	test	-	-	Azure Risk Detection · Azure	Stealth Deobfuscate/Decode Files or Information	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-03	—	ceb55fd0-726e-4656-bf4e-b585b7f7d572
	Adversaries may look for details about the network configuration and settings of systems they access (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Network Configuration Discovery	-	low	frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'	2021-12-07	2025-10-19	a29c1813-ab1f-4dde-b489-330b952e91ae
	Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". (...)	Generic	test	network_connection	windows	Sysmon	Discovery System Network Configuration Discovery	-	medium	Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)	2023-04-24	2024-03-22	edf3485d-dac4-4d50-90e4-b0e5813f7e60
	Detects presence of a potentially xor encoded powershell command	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	medium	Sami Ruohonen, Harish Segar, Tim Shelton, Teymur Kheirkhabarov, Vasiliy Burov, oscd.community, Nasreddine Bencherchali	2018-09-05	2023-01-30	bb780e0c-16cf-4383-8383-1e5471db6cf9
	Detects enumeration of local network configuration	Generic	test	process_creation	linux	Sysmon	Discovery System Network Configuration Discovery	-	informational	Ömer Günal and remotephone, oscd.community	2020-10-06	2022-09-15	e7bd1cfa-b446-4c88-8afb-403bcd79e3fa
	Detects enumeration of local network configuration	Generic	test	process_creation	macos	-	Discovery System Network Configuration Discovery	-	informational	remotephone, oscd.community	2020-10-06	2024-08-29	58800443-f9fc-4d55-ae0c-98a3966dfb97
	Detects execution of "wget" to download a ".zip" or ".rar" files from "temp.sh". (...)	Emerging	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-06-16	—	60d050c4-e253-4d9a-b673-5ac100cfddfb
	Detects execution of "wget" to download a "tar" from an IP address that doesn't have a trusted certificate. (...)	Emerging	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-06-16	—	23835beb-ec38-4e74-a5d4-b99af6684e91
	Detects the execution of "openssl" to connect to an IP address. (...)	Emerging	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-06-16	—	60911c07-f989-4362-84af-c609828ef829
	Detects suspicious enumeration of the domain the user is associated with.	Placeholder	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Network Configuration Discovery	-	low	Christopher Peacock @SecurePeacock, SCYTHE @scythe_io	2023-02-09	2024-08-01	43311e65-84d8-42a5-b3d4-c94d9b67038f
Splunk	The following analytic identifies instances where four or more distinct detection analytics are associated with malicious command line behavior on a specific host. (...)	Correlation	stable	-	-	-	Execution Command and Scripting Interpreter Defense Impairment File and Directory Permissions Modification Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Impact System Shutdown/Reboot	-	medium	Teoderick Contreras, Splunk	2023-06-14	2026-05-13	e99fcc4f-c6b0-4443-aa2a-e3c85126ec9a

Title

Description

LunarLoader S1143

LunarLoader S1143

LunarLoader MITRE reference S1143

Standing S1143

Reach

Coverage

LunarLoader detections S1143