rule vbs_lampion_w3 {
    meta:
        description = "Rule to detect Lampion second stage vbs script that downloads the trojan zip and dll"
        author = "Pedro Lobo - Layer8.pt" 
        reference = "https://www.layer8.pt/PDFs/New%20Lampion%20banking%20Trojan%20variant%20in%20the%20wild.pdf"
        os = "mswindows"
        filetype = "vbs"
        maltype = "trojan"
        last_update = "2023-10-30"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/vbs.lampion"
        malpedia_rule_date = "20231114"
        malpedia_hash = ""
        malpedia_version = "20231114"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $encryptedURL1 = {73 6e 7d 5e 4a 6a 47 6a 26 66 36 69 3e 30 49 25 44 25 44 60 68 6b 53 69 6d 6a 76 62 67 65 7d 65 4b 61 36 57 4c 68 3c 65 5c 6b 69 64 64 5a 79 24 52 69 5e 29 5f 24 61 57 73 63 32 57 58 70 5d 65 24 64 76 57 2c 6d 26 69 2e 24 72 59 56 65 7b 63 6b 25 77 69 5b 65 4a 66 61 68 53 57 34 6a 6b 5b 5f 69 63 6a 57 5b 35 24 23 70 33 5f 6e 66 54 76} 
        $encryptedURL2 = {47 61 4a 5e 71 6a 3b 6a 71 66 6d 69 38 30 6f 25 47 25 6b 60 6c 6b 75 69 33 6a 67 62 35 65 29 65 63 61 40 57 43 68 38 65 5d 6b 4f 64 31 5a 36 24 6e 69 72 29 54 24 68 57 3e 63 3f 57 68 70 65 65 6d 64 67 57 6e 6d 57 69 41 24 39 59 45 65 23 63 26 25 42 66 5b 65 7a 5f 4b 5f 5c 6b 5a 6f 6c 5b 66 6a 54 68 6a 6b}
        $encrypted3 = {7d 5c 71 35 6f 33 2e 75} 
    condition:
        all of ($encrypted*)
}