Braziliya va Portugaliyadagi foydalanuvchilarga qaratilgan infektsiyalarni yashirish uchun fishing, obfuskatsiyalangan VBScript, PowerShell va qonuniy Windows ilovalarini birlashtirgan zararli dastur kampaniyalari.
Tadqiqot Overlord RAT, Lampion va zararli newdev.dll orqali yetkazilgan noma'lum yuklamani qamrab oladi.
Windows Error Reporting'ning o'zini ekspluatatsiya qilish o'rniga, hujumchilar uning komponentlari va nomlash konventsiyalarini taqlid qilib, zararli bajariladigan fayllar va rejalashtirilgan vazifalarni odatiy operatsion tizim faoliyati sifatida yashirishdi.
Overlord kampaniyasi Braziliya norozilik notariuslarini taqlid qilib, haqiqiy CNPJ biznes ro'yxatga olish raqamlari bilan shaxsiylashtirilgan havolalarni o'z ichiga olgan soxta huquqiy bildirishnomalarni yubordi.
Hujjatlarni ko'rsatish o'rniga, havolalar bajariladigan yoki MSI yuklamalariga kirish huquqini beradigan VBS yuklab oluvchilarni yetkazdi.
Skriptlar Chr() ifodalari yoki birlashtirish yordamida satrlarni yashirdi. Yuklab olishlar Dropbox va Google Cloud Storage'dan kelib chiqqan, bir nechta variantlarda avval curl ishlatilgan va PowerShell zaxira sifatida xizmat qilgan.
Batch skriptlari ma'muriy imtiyozlarni so'radi, Microsoft Defender istisnolarini qo'llashga urindi va fayllarni C:\ProgramData\Microsoft\Windows\WER ostiga joylashtirdi.
CLUpdater.exe deb nomlangan bajariladigan fayl "Windows Error Reporting" nomidan foydalanib ikkita rejalashtirilgan vazifa yaratdi.
Boshqa Go asosidagi yuklovchi VMware va VirtualBox kataloglarini tekshirdi, o'zini foydalanuvchi profilidagi WER katalogiga WerFault.exe sifatida nusxaladi va Startup jildida doimiylikni o'rnatdi.
Tanish fayl nomi muhim: bu Windows komponenti sifatida niqoblangan zararli dastur edi, Microsoft'ning qonuniy WerFault.exe fayli buzilganligi dalili emas.
Alohida batch asosidagi zanjir .NET va Win32 API havolalarini dinamik ravishda qurdi, o'rnatilgan Base64 yuklamani dekodladi, bajariladigan xotirani ajratdi va uni yangi ip orqali ishga tushirdi. Bu dekodlangan yuklamani diskka yozishdan qochdi.
Goiás shtati Norozilik Notariusi tomonidan firibgarlik haqida ogohlantirish (Manba: WatchGuard).
Tadqiqotchilar shuningdek Chaskey bilan qarshi rejimda himoyalangan Donut x64 shellcode'ni o'z ichiga olgan shifrlangan werdata.db faylini topdilar.
WatchGuard Red Cell tadqiqotchisi Euler Neto uchta VBScript (VBS) bilan bog'liq zararli dastur kampaniyasini tekshirib, kiberjinoyatchilar fishing, obfuskatsiyalangan skriptlar va qonuniy Windows komponentlarini qanday birlashtirishini ochib berdi.
Konfiguratsiya tekshiruvlari, OVERLORD-SECURE-LOG satri va tarmoq trafigi faoliyatni 191[.]96[.]225[.]125 manzilidagi Overlord RAT infratuzilmasi bilan bog'ladi.
MSI variantlari DLL yon yuklashdan foydalandi, zararli kutubxonalarni qonuniy ngentask.exe yoki VLC bajariladigan fayllari bilan juftlashtirdi.
Ushbu namunalar 45[.]158[.]8[.]213 bilan bog'landi, bu ishonchli ilovalar hujumchi nazoratidagi kod uchun bajarilish mezbonlari bo'lishi mumkinligini ko'rsatadi.
Batch faylida Defender istisnosi va curl yoki PowerShell bajarilishi (Manba: WatchGuard).
Lampion kampaniyasi moliyaviy hujjat fishingi va HTML jalb etuvchilarni o'z ichiga olgan ZIP ilovalaridan foydalandi, bu jabrlanuvchilarni zararli VBS fayllariga yo'naltirdi.
Neto skriptlar taxminan 5 KB bajariladigan mantiqni o'z ichiga olganiga qaramay, taxminan 5 MB gacha shishirilganini aniqladi.
Tegishli Acronis tadqiqoti Portugaliyaga qaratilgan Lampion operatsiyasini hujjatlashtirdi, unda aniqlashlarning 94,6% Portugaliyada sodir bo'ldi.
Uning zanjiri rejalashtirilgan vazifalar, keng qamrovli skript obfuskatsiyasi va taxminan 750 MB hajmdagi og'ir to'ldirilgan DLL yuklamasidan foydalandi.
Bitsight alohida Lampion'ning buzilgan elektron pochta hisoblari, bulutda joylashtirilgan bosqichlar va ClickFix jalb etuvchilaridan foydalanishini hujjatlashtirdi.
Ushbu o'xshashliklar taktik ustunlikni o'rnatadi, ammo yetti raqamiga takroriy havolalar kampaniyalar bo'ylab umumiy operatorlarni mustaqil ravishda isbotlamaydi.
Uchinchi kampaniya soxta CAPTCHA bilan Portugaliya hisob-faktura yuklab olish sahifasini taqdim etdi, bu ISO yetkazdi.
Zararli dastur tarqatuvchi soxta sahifa (Manba: WatchGuard).
Ichkarida, obfuskatsiyalangan VBS DLL yon yuklash orqali qonuniy VMware vnetlib.exe bilan birga zararli newdev.dll'ni ishga tushirdi.
Kutubxona RunAgent'ni ochib beradigan o'rnatilgan Pascal DLL'ni dekodladi. Uning funksionalligi yagona nusxa majburlash, skrinshot o'lchamlari konfiguratsiyasi, HKCU ro'yxatga olish doimiyligi va bot identifikatori yaratishni o'z ichiga oldi.
Kuzatilgan buyruq va nazorat trafigi 148[.]224[.]62[.]243:7777 manziliga qaratilgan, muvaffaqiyatsiz ulanishlarni har uch soniyada qayta urinish.
Birlashtirilgan natijalar tadqiqot ustuvorliklarini ta'kidlaydi: WER nomli shubhali vazifalar, Defender istisnolari, kutilmagan skriptdan PowerShell bajarilishi va qo'shni DLL'larni yuklayotgan ishonchli binarlar.
Ushbu xatti-harakatlarni korrelyatsiya qilish fayl nomlari, ilova imzolari yoki bulut joylashuvi obro'siga ishonishdan ko'ra kuchliroq tadqiqot kontekstini ta'minlaydi.
Ushbu holatlarda hal qiluvchi naqsh bitta zararli vosita emas, balki skriptlash, ishonchli bajarilish yo'llari va doimiylik mexanizmlarining muvofiqlashtirilgan suiiste'moli bo'lib, buzilishni yashirishdir.
Malware campaigns that combine phishing, obfuscated VBScript, PowerShell, and legitimate Windows applications to conceal infections targeting users in Brazil and Portugal.
The investigation covers Overlord RAT, Lampion, and an unidentified payload delivered through a malicious newdev.dll.
Rather than exploiting Windows Error Reporting itself, attackers impersonated its components and naming conventions, disguising malicious executables and scheduled tasks as routine operating system activity.
The Overlord campaign impersonated Brazilian protest notaries, sending fraudulent legal notices containing links personalized with valid CNPJ business registration numbers.
Instead of displaying documents, the links delivered VBS downloaders that retrieved executable or MSI payloads access.
Scripts concealed strings using Chr() expressions or concatenation. Downloads originated from Dropbox and Google Cloud Storage, with curl used first and PowerShell serving as a fallback in several variants.
Batch scripts requested administrative privileges, attempted Microsoft Defender exclusions, and placed files under C:\ProgramData\Microsoft\Windows\WER.
One executable, CLUpdater.exe, created two scheduled tasks using the name “Windows Error Reporting.”
Another Go-based loader checked for VMware and VirtualBox directories, copied itself into a user-profile WER directory as WerFault.exe, and established Startup-folder persistence.
The familiar filename is significant: this was malware masquerading as a Windows component, not evidence that Microsoft’s legitimate WerFault.exe was compromised.
A separate batch-based chain constructed .NET and Win32 API references dynamically, decoded an embedded Base64 payload, allocated executable memory, and launched it through a new thread. This avoided writing the decoded payload to disk.
Alert from the Protest Notary of the state of Goiás about the scam (Source : WatchGuard).
Researchers also recovered werdata.db, an encrypted file containing Donut x64 shellcode protected with Chaskey in counter mode.
WatchGuard Red Cell researcher Euler Neto investigated, three malware campaigns involving VBScript (VBS), revealing how cybercriminals combine phishing, obfuscated scripts, and legitimate Windows components.
Configuration checks, the string OVERLORD-SECURE-LOG, and network traffic connected the activity to Overlord RAT infrastructure at 191[.]96[.]225[.]125.
MSI variants used DLL side-loading, pairing malicious libraries with legitimate ngentask.exe or VLC executables.
Those samples contacted 45[.]158[.]8[.]213, illustrating how trusted applications can become execution hosts for attacker-controlled code.
Defender exclusion and curl or PowerShell execution in the batch file (Source : WatchGuard).
The Lampion campaign used financial-document phishing and ZIP attachments containing HTML lures that led victims toward malicious VBS files.
Neto found scripts inflated to approximately 5 MB despite containing roughly 5 KB of executable logic.
Related Acronis research documented a Portugal-focused Lampion operation in which 94.6% of detections occurred in Portugal.
Its chain used scheduled tasks, extensive script obfuscation, and a heavily padded DLL payload of approximately 750 MB.
Bitsight separately documented Lampion’s use of compromised email accounts, cloud-hosted stages, and ClickFix lures.
These similarities establish tactical overlap, but repeated references to the number seven do not independently prove shared operators across the campaigns.
The third campaign presented a Portuguese invoice-download page with a fake CAPTCHAthat delivered an ISO.
Fake page that distributes the malware (Source : WatchGuard).
Inside, an obfuscated VBS launched legitimate VMware vnetlib.exe alongside malicious newdev.dll through DLL side-loading.
The library decrypted an embedded Pascal DLL exposing RunAgent. Its functionality included single-instance enforcement, screenshot-resolution configuration, HKCU registry persistence, and bot-identifier generation.
Observed command-and-control traffic targeted 148[.]224[.]62[.]243:7777, retrying failed connections every three seconds.
The combined findings highlight investigation priorities: suspicious WER-named tasks, Defender exclusions, unexpected script-to-PowerShell execution, and trusted binaries loading adjacent DLLs.
Correlating these behaviors provides stronger investigative context than trusting filenames, application signatures, or cloud-hosting reputations alone.
Across these cases, the decisive pattern is not one malicious tool, but coordinated abuse of scripting, trusted execution paths, and persistence mechanisms to obscure compromise.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.