Overlord and Lampion campaigns hide malware with Windows tools
Original title: Hackers Use PowerShell and Windows Error Reporting to Hide Malware on Infected PCs
Phishing in Brazil and Portugal delivers VBScript downloaders that persist as fake Windows Error Reporting tasks and side-loaded DLLs.
WatchGuard described three campaigns that combine phishing, obfuscated VBScript, PowerShell, and legitimate Windows binaries. Overlord impersonated Brazilian protest notaries and installed Overlord RAT; Lampion used financial lures, mainly in Portugal; a third chain side-loaded malicious newdev.dll. Attackers copied Windows Error Reporting names and paths rather than exploiting the component.
Unconfirmed: Tactical overlap does not establish shared operators, and the third payload is unidentified.
- Overlord used CNPJ-personalized links, Dropbox and Google Cloud Storage, and 191.96.225.125.
- A Go loader copied itself as WerFault.exe and created tasks named Windows Error Reporting.
- Lampion scripts were about 5 MB with roughly 5 KB of logic; 94.6% of Acronis detections were in Portugal.
- The third chain contacted 148.224.62.243:7777 and side-loaded newdev.dll beside VMware vnetlib.exe.
- MSI samples paired malicious DLLs with ngentask.exe or VLC and contacted 45.158.8.213.
Impact: Malware execution and remote control after phishing
- 1.Hunt for WER-named scheduled tasks, Defender exclusions, and trusted binaries loading adjacent DLLs.
- ATT&CK
- T1566.002 Spearphishing LinkT1566.001 Spearphishing AttachmentT1059.001 PowerShellT1059.005 Visual BasicT1574.002 DLL Side-Loading
- Malware
- Overlord RATLampionDonut
- Organizations
- WatchGuardAcronisBitsight
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 148.224.62.243 | r generation. Observed command-and-control traffic targeted 148[.]224[.]62[.]243:7777, retrying failed connections every three seconds |
| ipv4 | 45.158.8.213 | te ngentask.exe or VLC executables. Those samples contacted 45[.]158[.]8[.]213, illustrating how trusted applications can become exe |
From the original article
3 min read at gbhackers.com
Malware campaigns that combine phishing, obfuscated VBScript, PowerShell, and legitimate Windows applications to conceal infections targeting users in Brazil and Portugal. The investigation covers Overlord RAT, Lampion, and an unidentified payload delivered through a malicious newdev. dll.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.