Loading malware…
Lampion is a Brazilian banking malware family, linked to the ChePro lineage, that has been active since at least 2019 and has persistently targeted Portuguese-speaking victims, especially in Portugal. It is commonly described as a banking Trojan, but recent campaigns also use a DLL-based remote-access component as the primary final payload. Activity has focused on Portuguese government, finance, transportation, and general internet users, with lures and branding localized to Portuguese institutions and services.
Lampion is typically delivered through phishing campaigns using payment- or administrative-themed lures, often with ZIP attachments containing HTML, JavaScript, and heavily obfuscated Visual Basic Script stages. Campaigns have impersonated tax authorities, financial entities, and trusted Portuguese brands. More recent operations also adopted ClickFix-style social engineering, tricking victims into manually executing malicious PowerShell that retrieves staged VBS loaders. SEO poisoning and compromised websites have also been reported as distribution mechanisms in newer variants.
The malware uses a multistage infection chain with strong emphasis on defense evasion. Observed loaders and intermediate stages are frequently padded with large amounts of junk data to hinder static analysis and antivirus scanning, and execution is often split across separate scripts, scheduled tasks, and delayed stages to complicate process-tree correlation. Lampion has used encrypted or obfuscated strings, dynamic script generation, single-instance checks, and cleanup of competing script artifacts. It has also demonstrated sandbox and virtual-machine evasion, including trap-flag-based anti-analysis checks that terminate execution when a virtualized analysis environment is detected.
Persistence is commonly established through Windows Task Scheduler and startup-folder artifacts. Later-stage scripts fingerprint the victim system, gather host and security-product information, generate a unique victim identifier, and communicate with command-and-control infrastructure. Some campaigns downloaded oversized DLL payloads in chunks and executed them through rundll32. The final payload has been described as the main RAT component, enabling remote access and data theft.
Lampion’s core objective is theft of banking information. It monitors processes and browser page titles for targeted Portuguese and Brazilian financial institutions and can present fraudulent banking overlays to capture credentials. Reporting also associates the family with reconnaissance, collection of host telemetry, and exfiltration of victim data. Some variants have used cloud-hosted services during staging, and one documented technique retrieved a decryption key from a cloud document, with removal of that document functioning as a kill switch.
Lampion remains notable for its longevity and relative tactical consistency: rather than frequent reinvention, operators continue to rely on localized phishing, script-heavy staging, oversized padded components, scheduled-task persistence, anti-analysis checks, and banking-focused credential theft against Portuguese-speaking targets.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
This piece of malware is known for the usage of the Portuguese Government Finance & Tax (Autoridade Tributária e Aduaneira) email templates to lure victims to install the malicious loader (a VBS file). However, fake templates of banking organizations in Portugal have been used by criminals to disseminate the threat in the wild.
Emails templates are delivering malicious PDFs impersonating banking organizations in Portugal to spread Lampion trojan.
The email sent to the recipient is sent a proof of payment and other documents, which are accessible at the URL hXXps://we[.]tl/t-pNvQIG8UJS. When the recipient interacts with the URL, they are directed to the page where they can download a ZIP file containing the documents referenced in the email.
another VBS ( jghfszcekwr.vbs ) is created with code responsible for executing the previous VBS file ( sznyetzkkg.vbs ) via a scheduled task also created by the 1st VBS loader.
A scheduled task is created with the service description and author Administrator user associated. This scheduled task will execute the second VBS file jghfszcekwr.vbs
Next, it will initiate a wscript process... Upon running the larger script, another wscript process is initiated.
Creates a .cmd file into the Windows startup folder to maintain persistence.
another VBS ( jghfszcekwr.vbs ) is created with code responsible for executing the previous VBS file ( sznyetzkkg.vbs ) via a scheduled task also created by the 1st VBS loader.
A scheduled task is created with the service description and author Administrator user associated. This scheduled task will execute the second VBS file jghfszcekwr.vbs
another VBS ( jghfszcekwr.vbs ) is created with code responsible for executing the previous VBS file ( sznyetzkkg.vbs ) via a scheduled task also created by the 1st VBS loader.
A scheduled task is created with the service description and author Administrator user associated. This scheduled task will execute the second VBS file jghfszcekwr.vbs
The P-17-4 DLL is then renamed when downloaded and injected into the memory via the DLL injection technique.
criminals are enlarging the file size around 56 MB of junk to bypass its detection... The VBS file contains a lot of junk sequences, and after some rounds of code cleaning and deobfuscation, 31.7 MB of useless lines of code were removed.
the 2nd DLL called “ soprateste.zip ” which is protected with a hardcoded password.
The strongest tactic taken would be spoofing a legitimate company, which could potentially be a result of compromised credentials.
The P-17-4 DLL is then renamed when downloaded and injected into the memory via the DLL injection technique.
the Lampion Portuguese banking trojan used a Google Docs text document as the source for a key required to unlock some of its code—and deleting the document acted as a kill-switch.
C:\Windows\System32\rundll32.dll\”%AppData%\Local\Temp\rand_folder\random_name.dll” mJ8Lf9v0GZnptOVNB2I
Malware can detect whether it is executing in a physical or virtual machine (VM) by monitoring the response of the CPU after setting this single bit. ... When the malware finds out it is executing in a virtual machine, it will terminate its execution or provide fake outputs to hide its real intentions.
Some of the most common evasion techniques involve malware conducting various system checks against the environment it is executing in. For example, malware will often look for abnormal screen resolution, hard disk and physical memory size.
When started, the trojan collects information about the opened processes on the target machine.
The final VBS component performs victim checks, gathers system information, and contacts command-and-control infrastructure for the next payload.
Malware can detect whether it is executing in a physical or virtual machine (VM) by monitoring the response of the CPU after setting this single bit. ... When the malware finds out it is executing in a virtual machine, it will terminate its execution or provide fake outputs to hide its real intentions.
Some of the most common evasion techniques involve malware conducting various system checks against the environment it is executing in. For example, malware will often look for abnormal screen resolution, hard disk and physical memory size.
The final VBS component performs victim checks, gathers system information, and contacts command-and-control infrastructure for the next payload.
Frequently, droppers and loaders use legitimate websites and cloud services with built-in TLS support to further disguise the traffic.
67 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Lampion is a Brazilian banking malware family used in phishing campaigns targeting Portuguese-speaking victims. In this campaign it is delivered through fake payment receipt emails, staged via ZIP, padded HTML, JavaScript, and multiple VBS scripts, then deployed as a heavily padded 750MB DLL that executes via rundll32 and provides remote access, victim profiling, persistence through scheduled tasks, and supports data theft.
Lampion is a Brazilian banking malware family used in phishing campaigns against Portuguese-speaking victims. In this campaign it is delivered through ZIP, padded HTML, JavaScript, and multiple VBS stages, then downloads a heavily padded 750MB DLL payload that executes via rundll32, performs victim checks, gathers system information, establishes persistence with scheduled tasks, contacts C2 infrastructure, and provides remote access that can support data theft.
Lampion is a Brazil-linked banking trojan used in phishing campaigns against Portuguese organizations. Infection chains use malicious ZIP files, fake portals, and VBS scripts to establish persistence, contact command-and-control servers, and evade detection. Its final DLL payload functions as a remote access trojan that injects overlays into banking websites to steal credentials and collect reconnaissance data.
Brazilian banking trojan used in phishing campaigns targeting Portuguese organizations. Victims download a ZIP that triggers follow-on VBS scripts for persistence via scheduled tasks, C2 communication, and obfuscation; the final DLL acts as a RAT and can inject overlays into Portuguese banking websites to steal credentials and collect host and browser reconnaissance data.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.