SYMBOLCOMMON_NAMEaka. SYNONYMS
vbs.lampion (Back to overview)

vbs.lampion


Malware is delivered by emails, containing links to ZIP files or ZIP attachments. The ZIP contains a VBscript that, when executed, downloads additional files from AWS S3, Google Drive or other cloud hosting services. The downloaded files are encrypted .exe and .dll files.
The malware targets banking clients in Portugal.

References
2020-07-06Seguranca InformaticaPedro Tavares
@online{tavares:20200706:new:04c88bd, author = {Pedro Tavares}, title = {{New release of Lampion trojan spreads in Portugal with some improvements on the VBS downloader}}, date = {2020-07-06}, organization = {Seguranca Informatica}, url = {https://seguranca-informatica.pt/new-release-of-lampion-trojan-spreads-in-portugal-with-some-improvements-on-the-vbs-downloader}, language = {English}, urldate = {2020-07-07} } New release of Lampion trojan spreads in Portugal with some improvements on the VBS downloader
vbs.lampion
2020-05-11Seguranca InformaticaPedro Tavares
@online{tavares:20200511:trojan:65a40dd, author = {Pedro Tavares}, title = {{Trojan Lampion is back after 3 months}}, date = {2020-05-11}, organization = {Seguranca Informatica}, url = {https://seguranca-informatica.pt/trojan-lampion-is-back-after-3-months/}, language = {English}, urldate = {2020-05-13} } Trojan Lampion is back after 3 months
vbs.lampion
2019-12-30Check PointCheck Point
@techreport{point:20191230:threat:e0f0191, author = {Check Point}, title = {{THREAT INTELLIGENCE REPORT}}, date = {2019-12-30}, institution = {Check Point}, url = {https://research.checkpoint.com/wp-content/uploads/2019/12/Threat_Intelligence_News_2019-12-30.pdf}, language = {English}, urldate = {2020-01-08} } THREAT INTELLIGENCE REPORT
vbs.lampion
2019-12-26Seguranca InformaticaPedro Tavares
@online{tavares:20191226:targeting:aeef71f, author = {Pedro Tavares}, title = {{Targeting Portugal: A new trojan ‘Lampion’ has spread using template emails from the Portuguese Government Finance & Tax}}, date = {2019-12-26}, organization = {Seguranca Informatica}, url = {https://seguranca-informatica.pt/targeting-portugal-a-new-trojan-lampion-has-spread-using-template-emails-from-the-portuguese-government-finance-tax/}, language = {English}, urldate = {2020-01-09} } Targeting Portugal: A new trojan ‘Lampion’ has spread using template emails from the Portuguese Government Finance & Tax
vbs.lampion

There is no Yara-Signature yet.