Lunixar
Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts.
Tool overview
- Category
- RMM
- Research authors
- Michael Haag
- Created
- 2026-04-23
- Last modified
- 2026-06-15
- Privileges
- Not recorded
- Free / availability
- Not recorded
- Verification required
- Official vendor documentation confirms Lunixar SAS de CV controls agent installer naming and prevents renaming generated agent installers from the platform; prior renamed MSI filenames remain documented as historical abuse artifacts.
- Supported platforms
Windows
Capabilities
Executables & installation paths
- Filename
- Lunixar.exe
- OriginalFileName
- Not recorded
- Description
- Not recorded
Installation paths
FORENSIC EVIDENCE
Disk artifacts
- Description
- Main agent DLL
- File
- C:\Program Files\Lunixar\Lunixar.dll
- OS
- Windows
- Description
- Agent core library
- File
- C:\Program Files\Lunixar\Lunixar.Agent.Core.dll
- OS
- Windows
- Description
- Remote access executable
- File
- C:\Program Files\Lunixar\LunixarRemote.exe
- OS
- Windows
- Description
- Remote access library
- File
- C:\Program Files\Lunixar\LunixarRemote.dll
- OS
- Windows
- Description
- Auto-updater executable
- File
- C:\Program Files\Lunixar\LunixarUpdater.exe
- OS
- Windows
- Description
- Auto-updater library
- File
- C:\Program Files\Lunixar\LunixarUpdater.dll
- OS
- Windows
FORENSIC EVIDENCE
Event log artifacts
- Description
- Service event log source
- EventId
- Not recorded
- Provider
- Lunixar rmm-client service
FORENSIC EVIDENCE
Registry artifacts
- Description
- Windows service registration
- Path
- HKLM\System\CurrentControlSet\Services\LunixarRMM
- Key
- ImagePath
- Value
- "C:\Program Files\Lunixar\Lunixar.exe"
FORENSIC EVIDENCE
Network artifacts
- Description
- Known remote domains
- Domains
- *.lunixar.com
- lunixar.com
- app.lunixar.com
- socket.lunixar.com
- downloads.lunixar.com
- devrmm.lunixar.com
- Ports
- 23501
- Description
- Known abuse/phishing domains distributing renamed Lunixar MSI
- Domains
- mymeetinggoogle.com
- Ports
- Not recorded
FORENSIC EVIDENCE
Other artifacts
- Type
- Installer control
- Value
- Current Lunixar agent installers use platform-controlled names and cannot be renamed from the Lunixar console; historical renamed MSI filenames should be treated as abuse artifacts rather than expected current installer names.