# Overlord RAT and Lampion Campaigns Use PowerShell and Windows Error Reporting Impersonation to Hide Malware (Brazil, Portugal) > Three VBScript-led malware campaigns documented by WatchGuard Red Cell target Brazil and Portugal with Overlord RAT, the Lampion banking trojan, and a Pascal RAT loaded via a malicious newdev.dll. They combine phishing, obfuscated VBS, PowerShell, DLL side-loading and Windows Error Reporting impersonation (WerFault.exe, scheduled tasks, WER directories) to blend in with routine OS activity. - **Published:** 2026-10-26T07:52:08Z - **Last reviewed:** 2026-10-26T07:52:08Z - **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4435 - **ID:** TL-2026-4435 - **Severity:** HIGH - **Category:** MALWARE - **Status:** ACTIVE - **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier) ## Description WatchGuard Red Cell researcher Euler Neto (published 2026-10-22) analysed three related campaigns that rely on obfuscated VBScript, cloud-hosted payloads and legitimate Windows or third-party binaries to conceal infection. Case 1 - Overlord RAT (Brazil): Phishing emails impersonate Brazilian notary/protest offices, using lookalike domains with URLs of the form https:///visualizar-protesto.pdf/cnpj=. A Chr()-obfuscated VBS (comments in Brazilian Portuguese) downloads either an EXE (Update.exe, copied as WerFault.exe) or an MSI (update.msi, agent.msi, agent777.msi) from Dropbox, a Google Cloud Storage bucket (protesto-att / win777win) or resolvecenprot.com. Payloads are placed in C:\ProgramData\Microsoft\Windows\WER, and MSI variants drop legitimate ngentask.exe or vlc.exe into %APPDATA%\Local\Temp\Adobe for DLL side-loading. Batch scripts (downloader.bat, 7seven7.bat) request elevation or use RunAs, add install directories to Microsoft Defender exclusions, and run heavily obfuscated PowerShell that builds in-memory .NET assemblies via System.Reflection.Emit (resolving CreateThread, VirtualAlloc, WaitForSingleObject dynamically) and executes a Base64-decoded payload of 20MB+ embedded after '::' comment lines. Persistence uses scheduled tasks named WindowsErrorReporting and WindowsErrorReportingHourly that run WerFault.exe, plus the Startup folder. The final 64-bit Go payload checks for VMware/VirtualBox installation paths, downloads werdata.db (Chaskey counter-mode encrypted Donut x64 shellcode), checks config/settings.json and config/server_index.json, and uses the key string OVERLORD-SECURE-LOG. C2 is 191.96.225.125:5173 (primary) and 45.158.8.213:5173 (secondary), both hosted in Brazil. Execution strings reference Brazilian financial institutions (C6Bank, Picpay, Banco Pan, Banco Inter, Banco Original, Caixa Economica Federal, Modalmais). Case 2 - Lampion (Portugal): Phishing emails carry ZIP attachments named COMPROVATIVO-__--2026_.zip containing an HTML file that links to a VBS (Comprovativo__--2026-.vbs) hosted on AWS S3 or Google Drive. The VBS is inflated to about 5MB of junk code around roughly 5KB of logic and uses the pivot string 'user7' for string deobfuscation. Capabilities include victim fingerprinting, AV product discovery, scheduled-task persistence and a final DLL acting as a RAT with data exfiltration. Acronis TRU reported 94.6% of detections of a related Lampion operation were in Portugal. Case 3 - newdev.dll (Portugal): A Portuguese-language page titled 'Download Seguro - Factura' uses a fake CAPTCHA to deliver an ISO containing Arquivo.vbs (about 50KB, byte-wise custom decoding, FileSystemObject/WScript.Shell), VMware's legitimate vnetlib.exe, a malicious newdev.dll and a .def file. vnetlib.exe side-loads newdev.dll, whose export FEpibGGkiLSEccb0hUxnWWcBswPWJP XOR-decrypts a hidden 64-bit Free Pascal DLL from the .data section exposing RunAgent. RunAgent creates a single-instance mutex, calls SetProcessDpiAwarenessContext for full-resolution screenshots, sets HKCU Run persistence pointing to vnetlib.exe, generates a bot ID with CryptGenRandom and beacons to 148.224.62.243:7777 (retry every 3 seconds). Commands cover remote mouse/keyboard (0x04), PowerShell/CMD execution (0x05), file writes (0x09/0x0A), screen streaming (0x0C), hidden interactive shell (0x0D/0x0F/0x12), process kill (0x14) and uninstall with evidence removal (0x15). The recurring number 7 (user7, win777win, 777.sgn, agent777.msi, 7seven7.bat, port 7777) and Brazil-hosted infrastructure suggest possible shared operators, but WatchGuard does not name an actor and no CVE is involved. Severity is analyst-assigned. ## MITRE ATT&CK - T1566.002 Spearphishing Link - T1566.001 Spearphishing Attachment - T1204.002 Malicious File - T1059.005 Visual Basic - T1059.001 PowerShell - T1059.003 Windows Command Shell - T1053.005 Scheduled Task - T1547.001 Registry Run Keys / Startup Folder - T1574.001 DLL - T1036.004 Masquerade Task or Service - T1036.005 Match Legitimate Resource Name or Location - T1027.010 Command Obfuscation - T1140 Deobfuscate/Decode Files or Information - T1620 Reflective Code Loading - T1685 Disable or Modify Tools - T1497.001 System Checks - T1070.004 File Deletion - T1113 Screen Capture ## Sources - [Hackers Use PowerShell and Windows Error Reporting to Hide Malware on Infected PCs](https://gbhackers.com/windows-tools-to-hide-malware/) - [WatchGuard Secplicity: How VBScript malware hides behind trusted tools to evade detection (Euler Neto, Red Cell)](https://www.watchguard.com/wgrd-security-hub/secplicity-blog/how-vbscript-malware-hides-behind-trusted-tools-evade-detection) - [Overlord RAT Uses Fake Legal Notices to Infect Windows PCs (Hackread)](https://hackread.com/overlord-rat-fake-legal-notices-infect-windows-pcs/) - [Acronis Threat Research Unit: Lampion phishing campaign focused on Portugal](https://www.acronis.com/pt/tru/posts/) - [New release of Lampion trojan spreads in Portugal with some improvements on the VBS downloader](https://seguranca-informatica.pt/new-release-of-lampion-trojan-spreads-in-portugal-with-some-improvements-on-the-vbs-downloader/) - [Tax-Themed Phishing Delivers Overlord RAT via VHDX Image (Gurucul)](https://gurucul.com/blog/tax-themed-phishing-campaign-delivers-overlord-rat-via-a-malicious-vhdx-image/) - [Bitsight: Brazil Love - New tactics of Lampion](https://www.bitsight.com/blog/brazil-love-new-tactics-lampion) - [Overlord RAT Malware Analysis, Overview by ANY.RUN](https://any.run/malware-trends/overlord/) ## Full data Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp Canonical: https://intel.threadlinqs.com/threat/TL-2026-4435