Overview

overview

10

Static

static

Update.zip

windows10-1703-x64

10

Update.zip

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Update.zip

  • Size

    35.7MB

  • Sample

    230119-al4m9sac9y

  • MD5

    1c950d3f6ebe961fc40584d71ff2a20e

  • SHA1

    829b36c08b416cde3be333dc2f91eab5ec96fe54

  • SHA256

    3a252ea82333db3b0190b6d1b842b0ef9a6dd4483c4bfb12e5432978e9253ab5

  • SHA512

    2b9c4991bff45a8623e005b8dd7bc700ceaaafbeadb713fdbc279d618ade8d916422724935e4a2f492fd05a4adbbee6afcf614c45cb73827e4405b84495a2256

  • SSDEEP

    786432:f6oCqpfbh7XlE4M1nHFer3hOs3hkhgiSF5Io4VeNp9+t6+Os0Whuhr2Wv9xpXygf:iopNlLGvnIr3hOs3a2iSDNr+4+OYWv9l

Score
10/10
lampionbankerevasionpersistencetrojan

Malware Config

Targets

    • Target

      Update.zip

    • Size

      35.7MB

    • MD5

      1c950d3f6ebe961fc40584d71ff2a20e

    • SHA1

      829b36c08b416cde3be333dc2f91eab5ec96fe54

    • SHA256

      3a252ea82333db3b0190b6d1b842b0ef9a6dd4483c4bfb12e5432978e9253ab5

    • SHA512

      2b9c4991bff45a8623e005b8dd7bc700ceaaafbeadb713fdbc279d618ade8d916422724935e4a2f492fd05a4adbbee6afcf614c45cb73827e4405b84495a2256

    • SSDEEP

      786432:f6oCqpfbh7XlE4M1nHFer3hOs3hkhgiSF5Io4VeNp9+t6+Os0Whuhr2Wv9xpXygf:iopNlLGvnIr3hOs3a2iSDNr+4+OYWv9l

    Score
    10/10
    lampionbankerevasionpersistencetrojan

    • Lampion

      Lampion is a banking trojan, targeting Portuguese speaking countries.

      trojanbankerlampion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks