high
Overlord RAT, Lampion and newdev.dll payload campaigns hide behind fake Windows Error Reporting components in Brazil and Portugal
1 fonte(s)
·
1 atualização(ões)
·
publicado 26/10/2026 04:19
·
coletado há 6 dias
WatchGuard Red Cell researcher Euler Neto documented three VBScript-driven malware campaigns targeting users in Brazil and Portugal. They deliver Overlord RAT, Lampion and an unidentified payload loaded through a malicious newdev.dll. The operators combine phishing, obfuscated scripts, PowerShell and legitimate Windows binaries to conceal infections. They impersonate Windows Error Reporting (WER) names and components, but the legitimate WerFault.exe was not compromised and no WER vulnerability is exploited. The Overlord lures impersonate Brazilian protest notaries and use links personalized with valid CNPJ numbers.
Detalhes técnicos
- Overlord RAT chain: phishing links deliver VBS downloaders with strings hidden via Chr() or concatenation. They fetch EXE or MSI payloads from Dropbox and Google Cloud Storage, using curl first and PowerShell as fallback.
- Batch scripts request admin privileges, try to add Microsoft Defender exclusions and drop files in
C:\ProgramData\Microsoft\Windows\WER. CLUpdater.exe creates two scheduled tasks named "Windows Error Reporting". - A Go-based loader checks for VMware and VirtualBox directories, copies itself as WerFault.exe into a user-profile WER directory and persists via the Startup folder.
- A separate batch chain builds .NET and Win32 API references dynamically, decodes an embedded Base64 payload, allocates executable memory and runs it in a new thread without writing it to disk. Researchers also recovered werdata.db, an encrypted file holding Donut x64 shellcode protected with Chaskey in counter mode.
- The string OVERLORD-SECURE-LOG, configuration checks and network traffic tie the activity to Overlord infrastructure at 191.96.225.125. MSI variants use DLL side-loading with legitimate ngentask.exe or VLC executables and contact 45.158.8.213.
- Lampion campaign: financial-document phishing with ZIP attachments containing HTML lures that lead to malicious VBS files. Scripts are inflated to about 5 MB for roughly 5 KB of logic. Related Acronis research found 94.6% of detections of a Lampion operation in Portugal, with a DLL padded to about 750 MB. Bitsight separately documented compromised email accounts, cloud-hosted stages and ClickFix lures. The overlaps are tactical and do not prove shared operators.
- Third campaign: a Portuguese invoice-download page with a fake CAPTCHA delivers an ISO. An obfuscated VBS launches legitimate VMware vnetlib.exe with malicious newdev.dll via side-loading. The library decrypts an embedded Pascal DLL exposing RunAgent, which enforces a single instance, sets screenshot resolution, persists via HKCU registry and generates a bot ID. C2 is 148.224.62.243:7777, with retries every three seconds.
Remediação
- Hunt for scheduled tasks and executables named after WER outside legitimate paths, and for unexpected Defender exclusions.
- Monitor script-to-PowerShell execution and trusted binaries loading adjacent DLLs.
- Correlate these behaviors rather than trusting filenames, signatures or cloud-hosting reputation.
Linha do tempo
-
Overlord RAT, Lampion and newdev.dll payload campaigns hide behind fake Windows Error Reporting components in Brazil and Portugal
ler a análise desta fonte ocultar
WatchGuard Red Cell researcher Euler Neto documented three VBScript-driven malware campaigns targeting users in Brazil and Portugal. They deliver Overlord RAT, Lampion and an unidentified payload loaded through a malicious newdev.dll. The operators combine phishing, obfuscated scripts, PowerShell and legitimate Windows binaries to conceal infections. They impersonate Windows Error Reporting (WER) names and components, but the legitimate WerFault.exe was not compromised and no WER vulnerability is exploited. The Overlord lures impersonate Brazilian protest notaries and use links personalized with valid CNPJ numbers.
Technical Details
- Overlord RAT chain: phishing links deliver VBS downloaders with strings hidden via Chr() or concatenation. They fetch EXE or MSI payloads from Dropbox and Google Cloud Storage, using curl first and PowerShell as fallback.
- Batch scripts request admin privileges, try to add Microsoft Defender exclusions and drop files in
C:\ProgramData\Microsoft\Windows\WER. CLUpdater.exe creates two scheduled tasks named "Windows Error Reporting". - A Go-based loader checks for VMware and VirtualBox directories, copies itself as WerFault.exe into a user-profile WER directory and persists via the Startup folder.
- A separate batch chain builds .NET and Win32 API references dynamically, decodes an embedded Base64 payload, allocates executable memory and runs it in a new thread without writing it to disk. Researchers also recovered werdata.db, an encrypted file holding Donut x64 shellcode protected with Chaskey in counter mode.
- The string OVERLORD-SECURE-LOG, configuration checks and network traffic tie the activity to Overlord infrastructure at 191.96.225.125. MSI variants use DLL side-loading with legitimate ngentask.exe or VLC executables and contact 45.158.8.213.
- Lampion campaign: financial-document phishing with ZIP attachments containing HTML lures that lead to malicious VBS files. Scripts are inflated to about 5 MB for roughly 5 KB of logic. Related Acronis research found 94.6% of detections of a Lampion operation in Portugal, with a DLL padded to about 750 MB. Bitsight separately documented compromised email accounts, cloud-hosted stages and ClickFix lures. The overlaps are tactical and do not prove shared operators.
- Third campaign: a Portuguese invoice-download page with a fake CAPTCHA delivers an ISO. An obfuscated VBS launches legitimate VMware vnetlib.exe with malicious newdev.dll via side-loading. The library decrypts an embedded Pascal DLL exposing RunAgent, which enforces a single instance, sets screenshot resolution, persists via HKCU registry and generates a bot ID. C2 is 148.224.62.243:7777, with retries every three seconds.
Remediation
- Hunt for scheduled tasks and executables named after WER outside legitimate paths, and for unexpected Defender exclusions.
- Monitor script-to-PowerShell execution and trusted binaries loading adjacent DLLs.
- Correlate these behaviors rather than trusting filenames, signatures or cloud-hosting reputation.