rule vbs_lampion_w4 {
    meta:
        description = "Rule to detect Lampion password protected zip file"
        author = "Pedro Lobo - Layer8.pt" 
        reference = "https://www.layer8.pt/PDFs/New%20Lampion%20banking%20Trojan%20variant%20in%20the%20wild.pdf"
        os = "mswindows"
        filetype = "zip"
        maltype = "trojan"
        last_update = "2023-10-30"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/vbs.lampion"
        malpedia_rule_date = "20231114"
        malpedia_hash = ""
        malpedia_version = "20231114"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $compressed_chinese_filename = {e5 a4 a9 e5 be 88 e7 be 8e ef bc 8c e5 a4 a9 e6 b0 a3 e6 99 b4 e6 9c 97 ef bc 8c e6 b1 a0 e7 95 94 e5 95 a4 e9 85 92 e5 92 8c e7 87 92 e7 83 a4 ef bc 8c e5 ae b6 e4 ba ba e6 84 9f e5 8b 95 e6 88 91 e7 9a 84 e4 b8 8a e5 b8 9d e4 bf 9d e8 ad b7 e6 88 91 e7 9a 84 e7 9b 9f e5 8f 8b} 
        $zipPasswordedHeader = {50 4B 03 04 14 00 09 08}
    condition:
        $compressed_chinese_filename and $zipPasswordedHeader at 0
}