{
  "Name": "Lunixar",
  "Category": "RMM",
  "Description": "Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts.",
  "Author": "Michael Haag",
  "Created": "2026-04-23",
  "LastModified": "2026-06-15",
  "Details": {
    "Website": "https://lunixar.com/en/",
    "PEMetadata": {
      "Filename": "Lunixar.exe",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "Official vendor documentation confirms Lunixar SAS de CV controls agent installer naming and prevents renaming generated agent installers from the platform; prior renamed MSI filenames remain documented as historical abuse artifacts.",
    "SupportedOS": [
      "Windows"
    ],
    "Capabilities": [
      "Remote access (browser and Windows app)",
      "Script execution and scheduling",
      "Hardware and software inventory",
      "Process and service management",
      "Real-time CPU/RAM/disk alerting"
    ],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "C:\\Program Files\\Lunixar\\*",
      "*\\Lunixar\\Lunixar.exe",
      "*\\Lunixar\\Lunixar.dll",
      "*\\Lunixar\\Lunixar.Agent.Core.dll",
      "*\\Lunixar\\LunixarRemote.exe",
      "*\\Lunixar\\LunixarRemote.dll",
      "*\\Lunixar\\LunixarUpdater.exe",
      "*\\Lunixar\\LunixarUpdater.dll",
      "LunixarRMM*.msi",
      "Googlemeet.msi",
      "eDocument-*.msi"
    ]
  },
  "Artifacts": {
    "Disk": [
      {
        "Description": "Main agent DLL",
        "File": "C:\\Program Files\\Lunixar\\Lunixar.dll",
        "OS": "Windows"
      },
      {
        "Description": "Agent core library",
        "File": "C:\\Program Files\\Lunixar\\Lunixar.Agent.Core.dll",
        "OS": "Windows"
      },
      {
        "Description": "Remote access executable",
        "File": "C:\\Program Files\\Lunixar\\LunixarRemote.exe",
        "OS": "Windows"
      },
      {
        "Description": "Remote access library",
        "File": "C:\\Program Files\\Lunixar\\LunixarRemote.dll",
        "OS": "Windows"
      },
      {
        "Description": "Auto-updater executable",
        "File": "C:\\Program Files\\Lunixar\\LunixarUpdater.exe",
        "OS": "Windows"
      },
      {
        "Description": "Auto-updater library",
        "File": "C:\\Program Files\\Lunixar\\LunixarUpdater.dll",
        "OS": "Windows"
      }
    ],
    "EventLog": [
      {
        "Description": "Service event log source",
        "EventId": "",
        "Provider": "Lunixar rmm-client service"
      }
    ],
    "Registry": [
      {
        "Description": "Windows service registration",
        "Path": "HKLM\\System\\CurrentControlSet\\Services\\LunixarRMM",
        "Key": "ImagePath",
        "Value": "\"C:\\Program Files\\Lunixar\\Lunixar.exe\""
      }
    ],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "*.lunixar.com",
          "lunixar.com",
          "app.lunixar.com",
          "socket.lunixar.com",
          "downloads.lunixar.com",
          "devrmm.lunixar.com"
        ],
        "Ports": [
          23501
        ]
      },
      {
        "Description": "Known abuse/phishing domains distributing renamed Lunixar MSI",
        "Domains": [
          "mymeetinggoogle.com"
        ],
        "Ports": []
      }
    ],
    "Other": [
      {
        "Type": "Installer control",
        "Value": "Current Lunixar agent installers use platform-controlled names and cannot be renamed from the Lunixar console; historical renamed MSI filenames should be treated as abuse artifacts rather than expected current installer names."
      }
    ]
  },
  "Detections": [],
  "References": [
    "https://lunixar.com/en/",
    "https://lunixar.com/en/rmm-abuse-prevention/",
    "https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/",
    "https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33"
  ],
  "Acknowledgement": []
}