Threat actors are targeting citizens in Portugal with spear-phishing emails containing a malicious URL. After the victim clicks the URL, a ZIP file is downloaded to the system. Then the second stage of the infection chain poisons the victim with the Lampion trojan. The malware uses multiple techniques to make analysis hard, including commercial anti reversing and cracking software, obfuscation, binary padding, masquerading, and software packing. The body of the decoy email appears to claim to be sent from the Portuguese Government Finance and Tax division to mislead the victim.

How to use this article:

1. If a Threat Hunting table has been created, use the rules contained to search for malware related to this campaign. 
2. Review the product detection table and confirm that your environment is at least on the specified content version.
   To download the latest content versions, go to the Security Updates page.
3. Scroll down and review the "Product Countermeasures" section of this article. Consider implementing them if they are not already in place.
4. Review KB91836 - Countermeasures for entry vector threats.
5. Review KB87843 - Dynamic Application Containment rules and best practices.
6. Review KB82925 - Identify what rule corresponds to an Adaptive Threat Protection and Threat Intelligence Exchange event.

Campaign IOC
 

Type	Value
URL	http://18.219.52.4/PT/VaiPostaProPai.php
URL	http://18.219.52.4/PT/index.php
URL	http://18.219.52.4/PT/admin.php
URL	http://18.219.52.4/PT/png/pt.png
URL	http://18.219.52.4/PT/SO/
URL	18.219.52.4/PT/painelADM.php
URL	18.219.52.4/PT/painel.php
URL	http://rebrand.ly/mmvk36?=NOWAUVJBNOWAUVJBNOWAUVJBNOWAUVJBNOWAUVJBNOWAUVJBNOWAUVJBNOWAUVJBNOWAUVJBNOWAUVJB
URL	http://100.26.189.49/PY/App.php?=5wzpz2e7xglkzmh
URL	https://fucktheworld.s3.us-east-2.amazonaws.com/0.zip
URL	https://sdghsuidhoidoghsdc19c.s3.us-east-2.amazonaws.com/P-19-2.dll
URL	http://18.219.52.4/PT/VaiPostaProPai.php
URL	http://18.219.52.4/PT/index.php
Ip-dst	18.219.52.4
MD5	03CD6B1EE8E044680B2316938FFF072F
MD5	064083751004FFEA3823DACBA3F5A334
MD5	0882167B48E8F08D704ADA381D4B1A07
MD5	141B9AA7FE85DBD9C14C83447FAA58C1
MD5	168612ED2DDFE62BCB31E8BDC414C045
MD5	18977C78983D5E3F59531BD6654AD20F
MD5	2135D5E3D9EEDBDB324AF6331D6C6BEA
MD5	2A22F9E6EEE207C35229063F75121696
MD5	2E98D98E8A55A16AD16CDC1130E5D729
MD5	3350E74A4CFA020F9B256194EAE25C12
MD5	3C36B6FDD3BAFC16376DD2BC68FEC317
MD5	466193AD538DC185FBBA76162241F970
MD5	4ABAC01F712759552AF2A889180E2FA0
MD5	4AED0075CCB90C72DFD7B6AE3EDC2D62
MD5	5053BA160D05456BCC919E2FE50AD30A
MD5	508BBB9D8EF028DC531631BF254CF816
MD5	516FA3C46FC576055885F69A6950F23C
MD5	533A5A5357DEB6BE4196DB062800738D
MD5	591A3ED820A2528A2E382E7D08ABA957
MD5	643C3E6DFD08A333478DFBAEAD9D090B
MD5	6D4C57B3600D896553E1A4AA0419DFEC
MD5	6D5196D8D9CD129B0F257F07EDE9E6AB
MD5	75819E8456648B85753F92CBD71AE002
MD5	76EED98B40DB9AD3DC1B10C80E957BA1
MD5	782FB7ADF7DF3203E365C42CA794F058
MD5	814FB0A1CC7A7CF376F3A302449FD2BD
MD5	86062F48BD830EC4940343039D5ABDE9
MD5	8796BFE9C4735FE01A04125C25E67ED8
MD5	8EB68A7CDE7DA57B6BB46B479B371067
MD5	A391A83144AA1E33912E38930291711B
MD5	AE5FD104186C3551B922492DE895EDF1
MD5	AF824991D302E19CFE49A158F5AA7320
MD5	B1E39AE9B6CF166F5AD765EE8C328576
MD5	BBAA1233FB187638501FEACD1A11DEBC
MD5	BDA91615347BE1D4C605C1C642FBBA4C
MD5	D05FF8C51B3CB5EAD20B4066A225AB52
MD5	D70F467D5FDF948C73896B69942C2FE4
MD5	DB6F2E6D1DC0641A9C2DC77BAEC41F6D
MD5	E04F1799BADDFBA25CDA9DA96777F382
MD5	E66571E6DD723B22E7283BA9F9C6267C
MD5	E7BDCE5505EE263530DEA04C2FDC661F
MD5	ED3D7DF970CB7833D6F10C6077FEA548
MD5	F92591044F8A48EA8F42370EE72731D3
MD5	FB20B1B1D48D96BACDE2FD6CAAEB42E7

Minimum Content Versions:

Content Type	Version
V2 DAT (VirusScan Enterprise)	9510
V3 DAT (Endpoint Security)	3961

 
 
Detection Summary
 

IOC	Scanner	Detection
03CD6B1EE8E044680B2316938FFF072F	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
064083751004FFEA3823DACBA3F5A334	AVEngine V2	VBS/agent.ep
	AVEngine V3	VBS/agent.ep
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
0882167B48E8F08D704ADA381D4B1A07	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
141B9AA7FE85DBD9C14C83447FAA58C1	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
168612ED2DDFE62BCB31E8BDC414C045	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
18977C78983D5E3F59531BD6654AD20F	AVEngine V2	Lampion!18977C78983D
	AVEngine V3	Lampion!18977C78983D
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
2135D5E3D9EEDBDB324AF6331D6C6BEA	AVEngine V2	VBS/agent.ep
	AVEngine V3	VBS/agent.ep
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
2A22F9E6EEE207C35229063F75121696	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
2E98D98E8A55A16AD16CDC1130E5D729	AVEngine V2	VBS/Agent.ep
	AVEngine V3	VBS/Agent.ep
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
3350E74A4CFA020F9B256194EAE25C12	AVEngine V2	VBS/Agent.eh
	AVEngine V3	VBS/Agent.eh
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
3C36B6FDD3BAFC16376DD2BC68FEC317	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
466193AD538DC185FBBA76162241F970	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
4ABAC01F712759552AF2A889180E2FA0	AVEngine V2	VBS/Lampion
	AVEngine V3	VBS/Lampion
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
4AED0075CCB90C72DFD7B6AE3EDC2D62	AVEngine V2	VBS/Agent.eh
	AVEngine V3	VBS/Agent.eh
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
5053BA160D05456BCC919E2FE50AD30A	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
508BBB9D8EF028DC531631BF254CF816	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
516FA3C46FC576055885F69A6950F23C	AVEngine V2	VBS/Agent.ep
	AVEngine V3	VBS/Agent.ep
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
533A5A5357DEB6BE4196DB062800738D	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
591A3ED820A2528A2E382E7D08ABA957	AVEngine V2	VBS/Agent.ep
	AVEngine V3	VBS/Agent.ep
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
643C3E6DFD08A333478DFBAEAD9D090B	AVEngine V2	VBS/Agent.ep
	AVEngine V3	VBS/Agent.ep
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
6D4C57B3600D896553E1A4AA0419DFEC	AVEngine V2	VBS/Agent.ep
	AVEngine V3	VBS/Agent.ep
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
6D5196D8D9CD129B0F257F07EDE9E6AB	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
75819E8456648B85753F92CBD71AE002	AVEngine V2	VBS/Agent.ep
	AVEngine V3	VBS/Agent.ep
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
76EED98B40DB9AD3DC1B10C80E957BA1	AVEngine V2	Packed-GV!76EED98B40DB
	AVEngine V3	Packed-GV!76EED98B40DB
	JTI (ATP Rules)	JTI/Suspect.196612!76eed98b40db
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
782FB7ADF7DF3203E365C42CA794F058	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
814FB0A1CC7A7CF376F3A302449FD2BD	AVEngine V2	VBS/Agent.ep
	AVEngine V3	VBS/Agent.ep
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
86062F48BD830EC4940343039D5ABDE9	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
8796BFE9C4735FE01A04125C25E67ED8	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
8EB68A7CDE7DA57B6BB46B479B371067	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
A391A83144AA1E33912E38930291711B	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
AE5FD104186C3551B922492DE895EDF1	AVEngine V2	VBS/Agent.ep
	AVEngine V3	VBS/Agent.ep
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
AF824991D302E19CFE49A158F5AA7320	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
B1E39AE9B6CF166F5AD765EE8C328576	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
BBAA1233FB187638501FEACD1A11DEBC	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
BDA91615347BE1D4C605C1C642FBBA4C	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
D05FF8C51B3CB5EAD20B4066A225AB52	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
D70F467D5FDF948C73896B69942C2FE4	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
DB6F2E6D1DC0641A9C2DC77BAEC41F6D	AVEngine V2	VBS/Agent.ep
	AVEngine V3	VBS/Agent.ep
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
E04F1799BADDFBA25CDA9DA96777F382	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
E66571E6DD723B22E7283BA9F9C6267C	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
E7BDCE5505EE263530DEA04C2FDC661F	AVEngine V2	VBS/Agent.eh
	AVEngine V3	VBS/Agent.eh
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
ED3D7DF970CB7833D6F10C6077FEA548	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
F92591044F8A48EA8F42370EE72731D3	AVEngine V2	VBS/Agent.ep
	AVEngine V3	VBS/Agent.ep
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
FB20B1B1D48D96BACDE2FD6CAAEB42E7	AVEngine V2	VBS/Agent.ei
	AVEngine V3	VBS/Agent.ei
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

                                                        
Minimum set of Manual Rules to improve protection to block this campaign

IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

Endpoint Security - Advanced Threat Protection:

Rule ID: 2 Use Enterprise file reputation to identify trusted or malicious files
Rule ID: 4 Use GTI file reputation to identify trusted or malicious files

 
Host Intrusion Prevention:

Rule ID: 2806 Attempt to create a hardlink to a file

 
Endpoint Security - Access Protection Custom Rules:

Rule: 1
Executables (Include):

?script.exe

Subrules:
Subrule Type: Files
Operations: Create
Targets (Include):

?:\users\*\appdata\roaming\*\*.zip
?:\users\*\appdata\roaming\*\*.exe

 
Virusscan Enterprise - Access Protection Rules:

Rule: 1
Rule Type: File
Process to include:

?script.exe

File or folder name to block:

?:\users\*\appdata\roaming\*\*.exe

File actions to prevent: Create
 
Rule: 2
Rule Type: File
Process to include: ?script.exe
File or folder name to block: ?:\users\*\appdata\roaming\*\*.zip
File actions to prevent: Create

Aggressive set of Manual Rules to improve protection to block this campaign

IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

Host Intrusion Prevention:

Rule ID: 6010 Generic Application Hooking Protection
Rule ID: 6053 Accessing other users home directory

 
Endpoint Security - Access Protection Rules:

Executing scripts by Windows script host (CScript.exe or Wscript.exe) from common user folders