Turla LightNeuron Malware Sample Download

ESET researchers have discovered LightNeuron , a backdoor that affects Microsoft Exchange mail servers. It can read, modify or block any email that passes on the server. It can even write new emails and send them under the guise of a legitimate user, chosen by an attacker. The malware hides itself in PDF and JPG documents and uses steganography to present incoming emails as harmless. Thus hides itself form mail filters. ESET malware researcher said that LightNeuron is the first known malware that misuses the mechanism of the Microsoft Exchange Transport Agent.

Turla LightNeuron has two main components a Transport Agent that is registered in the Microsoft Exchange configuration, and a companion 64-bit DLL containing most of the malicious code.

Turla LightNeuron Transport Agent Sample Signatures

Family: Backdoor:Win32/Turla.TA
MD5: 2b14f9f3c758a2cf842a61aca6a3455d
SHA256: 25facbc4265ca90f0508e77e97e1e6fcc7e46f6cca316b251b06d41232f6360c

Turla LightNeuron Transport Agent Sample Download

Turla LightNeuron Companion DLL Sample Signatures

Family: Backdoor:Win32/Turla.TA
MD5: 5924eac8af1f3e3f1f825998bc59c062
SHA256: 88c90c2b123a357423ab3241624cba49d57122ee3b8ff4130504090c174bb09d

Turla LightNeuron Companion DLL Sample Download