# Trojan Lampion is back after 3 months **seguranca-informatica.pt/trojan-lampion-is-back-after-3-months/** May 11, 2020 **Trojan Lampion is back after 3 months. The malware was observed last days with a new obfuscation layer, new C2, and distributed** **inside an MSI file.** [Trojan Lampion is a malware](https://malpedia.caad.fkie.fraunhofer.de/details/vbs.lampion) [observed at the end of the year 2019 impacting Portuguese users using template emails from the Portuguese](https://seguranca-informatica.pt/targeting-portugal-a-new-trojan-lampion-has-spread-using-template-emails-from-the-portuguese-government-finance-tax/#.XrmLfWhKhQA) **Government Finance & Tax and EDP.** [The latest campaigns in Portugal were observed during February 2020, according to the threat indicators available at 0xSI_f33d – The](https://feed.seguranca-informatica.pt/) _Portuguese Abuse Open Feed. A new modified version of this malware was observed during May 2020 using template emails that_ **impersonate an invoice from a Bank transaction, an invoice from Vodafone Group, and in another scenario, emergency funds provided** **by the Portuguese Government to help the COVID-19 fight.** Below, the email templates on how Lampion has been distributed in May 2020 in Portugal are presented. ## Lampion email templates – May 2020 **SAPO TRANSFER TEMPLATE** On May 8th, 2020, a fresh version of Lampion trojan was distributed using templates using the SAPO Transfer Cloud and the email related to a bank transfer. **_Figure 1: Lampion malware distributed via SAPO TRANSFER cloud._** As noted in previous campaigns, the threat is distributed on a VBS file along with other documents to lure victims. ----- **_Figure 2: Message included by crooks inside the PDF file._** **VODAFONE GROUP INVOICE TEMPLATE** In this scenario, a Microsoft Installer (MSI) file was used to disseminate the threat. The malicious file is downloaded from the Google API Cloud. ----- **_Figure 3: Lampion trojan distributed via an MSI file hosted on Google API Cloud._** **PORTUGUESE GOVERNAMENT TEMPLATE / COVID-19** ----- so, a S e as used to ect t e ct s ( o **_u a o_e_** **_e ge c a _go_** **_s )_** t s case, t e a c ous e as do oaded o a AWS S3 bucket. The modus operandi both malicious MSI file is the same and explained below. We are living in an era where crooks taking advantage of the pandemic situation to launch new waves of phishing and malware every day. ----- **_Figure 4: Malicious MSI file downloaded from AWS S3 bucket and using COVID-19 theme that impersonates the Portuguese Government_** ----- ## Lampion May 2020 Modus Operandi [According to the first appearance of this banking trojan in December 2019, the modus operandi remains as documented here. Only the way](https://seguranca-informatica.pt/targeting-portugal-a-new-trojan-lampion-has-spread-using-template-emails-from-the-portuguese-government-finance-tax/#.XrmLfWhKhQA) how the malware is distributed has been changed along the time. As observed in Figure 2, this is the classic form of Lampion. It poses as a VBS file along with other files, including an image and a PDF file to lure the victims. Nonetheless, Figure 3 and Figure 4 show another way how Lampion has been spread. Crooks are using an MSI file with the VBS file inside (1st stage), that is executed to infect the victim’s device. Also, the VBS file is harder to understand, it is a bit bit more overshadowed in contrast to the initial samples. In brief, these are the only changes observed in these fresh samples in contrast to December 2019. Analyzing the MSI file from Figure 4, it poses as a file sent from the Portuguese Government to help in the COVID-19 fight. Inside the MSI file is available the VBS file (Lampion – 1st stage), which is installed on “C:\Programs File (x86)\Firefox_2020-*\Firefox_2020***” when the MSI file is executed.** **_Figure 5: Lampion MSI file with the VBS file (1st stage) inside._** ----- **_Figure 6: MSI file installation dropping the VBS file (1st stage) inside the C:\Programs Files (x86) folder._** ----- **_Figure 7: VBS file (1st stage) available and executed from C:\Programs Files (x86) folder._** [From this point, the malware process is the same how documented in December 2019. However, the VBS file is now harder, with a new](https://seguranca-informatica.pt/targeting-portugal-a-new-trojan-lampion-has-spread-using-template-emails-from-the-portuguese-government-finance-tax/#.XrmLfWhKhQA) obfuscation round (see Figure 8 below). ----- **_Figure 8: Snippet of code – obfuscation differences between the VBS samples; December 2019 and May 2020._** The next stage is downloaded through the execution of the VBS file on the infected device. In order to decode the URLs, we use the snippet of [code available here.](https://github.com/sirpedrotavares/SI-LAB-malware/blob/master/decryption-strings-lampion.vbs) The analyzed samples (2nd stage) are download from the Google Cloud instead of AWS S3 buckets; as observed between December 2019 and February 2020. ``` --SAMPLES SAPO TRANSFER TEMPLATE-~wa^6jfjdfHik0z%S%miBj:emhVW\]+[W$\]Ve0e*];b.[&WifM_BiD$2YBePcj%^j1[bWScc#=cYe/Z+kYbOeEiufz%O&I$pp-_,fA' hxxps://storage.googleapis.]com/team-modulosp/0.]zip zH$^Uj[jHf2ir0[%u%YiEj'[email protected]]s[`$5]0e6e:]`bB[