Do Son 
At a Glance
| Malware family | Lampion, a Brazilian banking trojan from the ChePro lineage |
| Threat actor | No group named; operators tracked only as the Lampion crew |
| Targets | Portuguese speakers; 94.6% of detections in Portugal |
| Delivery vector | Phishing email with a ZIP attachment holding an obfuscated HTML lure |
| Key capabilities | Multistage VBS loader, scheduled-task persistence, host fingerprinting, remote access and data theft |
| Source | Acronis Threat Research Unit |
TL;DR
Acronis TRU is tracking a Lampion malware campaign that pushes fake payment receipts at Portuguese inboxes. Victims who open the attachment see a counterfeit SAPO file transfer page, which quietly pulls down a multistage VBS chain. The chain ends with a padded DLL that gives operators remote access.
Delivery
The lure is dull on purpose. Emails pose as routine financial or administrative notices and promise a payment receipt inside the attachment. Operators pad each message with a confidentiality notice, a mailbox disclaimer, and a full business signature.
The attachment is a ZIP file named after the Portuguese word for receipt, plus a month, a date, and a random string. Inside sits a single web document of roughly 1.3 MB, bloated with meaningless markup and random text.
A Fake SAPO Page Does the Talking
Opened in a browser, that file renders a convincing SAPO Transfer page. SAPO is a well-known Portuguese portal run by Altice Portugal, and Lampion has abused its branding before. Meanwhile, embedded JavaScript decodes an encrypted URL and fetches the next stage from attacker infrastructure.
Infection Chain
Every stage in this Portugal phishing campaign hides behind padding. Acronis describes the oversized files as “likely intended to hinder analysis and evade detection.”
The second-stage VBS script shows how far that goes. One analyzed sample weighed about 7 MB, yet held only around 22 KB of real code. It writes a downloader into the temp folder, then creates a scheduled task to fetch the final script.
That final stage runs to roughly 1,000 lines once analysts strip the junk. It enforces a single instance through WMI, deletes rival scripts in the temp folder, and builds a victim ID by hashing the username, hostname, BIOS, motherboard, and GPU details.
Command-and-Control and Data Exfiltration
The loader checks a marker file first. If no payload exists yet, it polls a C2 endpoint that answers with a download URL and a file name. Next, it sends a Base64 beacon carrying the hostname, username, machine fingerprint, and the name of the installed antivirus product.
Downloads arrive in 10 MB HTTP range chunks, which the script stitches back together on disk. Chunking exists for a reason: telemetry puts the final DLL near 750 MB, almost entirely junk padding. Independent reporting on earlier 700 MB-plus Lampion loaders matches that pattern.
Scheduled tasks then move the DLL into a timestamped folder under the roaming profile. Rundll32 launches it through an exported function named after a Brazilian raft fisherman, a nod to the family’s origins. From there, the DLL acts as the main RAT.
Attribution and Scope
Nobody has named a group. Attribution to the Lampion family itself is confirmed through code lineage and tradecraft, and the family dates to public reporting in December 2019. Acronis rates the geofencing and victim-tracking assessment at moderate confidence only.
Detections cluster hard: Portugal 94.6%, Spain 4.3%, and the United Kingdom 1.1%. Researchers read the last two as spillover.
Detection and Defense Guidance
- Block or quarantine HTML and VBS files arriving inside ZIP attachments.
- Alert on script files whose size dwarfs their real code volume.
- Watch for wscript.exe writing scripts into temp folders.
- Review scheduled tasks created by scripts, especially delayed self-restart tasks.
- Flag rundll32.exe loading DLLs from timestamped roaming profile folders.
- Investigate very large HTTP range downloads from unfamiliar domains.
Acronis closes on a blunt note: “the threat actor remains active and continues to refine its delivery techniques.” Portuguese organizations should treat unexpected receipt attachments as hostile until proven otherwise.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
