import "pe"
import "hash"

rule vbs_lampion_w2 {
    meta:
        description = "Rule to detect Lampion trojan dll"
        author = "Pedro Lobo - Layer8.pt" 
        reference = "https://www.layer8.pt/PDFs/New%20Lampion%20banking%20Trojan%20variant%20in%20the%20wild.pdf"
        os = "mswindows"
        filetype = "dll"
        maltype = "trojan"
        last_update = "2023-10-30"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/vbs.lampion"
        malpedia_rule_date = "20231114"
        malpedia_hash = ""
        malpedia_version = "20231114"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $a = "DoThisBicht" wide ascii
        $vmp0 = ".vmp0" wide ascii
        $vmp1 = ".vmp1" wide ascii
    condition:
        ($a and pe.DLL and $vmp0 and $vmp1) or
        hash.md5(0, filesize) == "25ca63d94eb39299563fa51986c9a17b" 
}