Old-School VBScript Lures Plant RATs Across Brazil and Portugal

Three malware campaigns aimed at Brazil and Portugal all start the same old-fashioned way: a VBScript file. WatchGuard researcher Euler Neto describes how the scripts lean on built-in Windows tools and legitimate signed programs to install remote-access trojans without dropping anything obviously suspicious. The campaigns are Overlord RAT, the long-running Lampion banking trojan, and a third WatchGuard tracks by its malicious newdev.dll.

191.96.225[.]125:5173 (Overlord RAT C2)
45.158.8[.]213:5173 (Overlord RAT C2, MSI variant)
148.224.62[.]243:7777 (newdev.dll campaign C2)
1protestorecife[.]com
2protestodesalvador[.]com
3protestobelem[.]com
cartorioquintela[.]com
cartoriosdeprotestogo[.]com
protestobh[.]com
protestocampinas[.]com
tabelionatojoinville[.]com
resolvecenprot[.]com

C:\ProgramData\Microsoft\Windows\WER\CLUpdater.exe
%APPDATA%\Microsoft\Windows\WER\WerFault.exe
Scheduled tasks: WindowsErrorReporting, WindowsErrorReportingHourly

Source article: How VBScript Malware Hides Behind Trusted Tools to Evade Detection
Publisher: WatchGuard Secplicity blog (Euler Neto, WatchGuard Red Cell)
Published: Oct. 22, 2026
URL: https://www.watchguard.com/wgrd-security-hub/secplicity-blog/how-vbscript-malware-hides-behind-trusted-tools-evade-detection

Executive Summary

WatchGuard describes three Brazil-linked remote-access campaigns that all begin with an obfuscated VBScript and then lean on built-in Windows tools and legitimately signed programs. The first is tracked as Overlord RAT (named for the OVERLORD-SECURE-LOG key string in its Go payload; no other vendor alias is given) and targets Brazil with emails impersonating protest notary offices (cartórios de protesto) that link to visualizar-protesto.pdf URLs on lookalike domains. The second is Lampion, the long-running Brazilian banking trojan aimed at Portugal, delivered as ZIP files named COMPROVATIVO-… that hold an HTML file linking to a VBS on cloud storage. The third has no name and is tracked by its side-loaded newdev.dll; it reaches Portuguese victims through a fake “Download Seguro – Factura” page with a fake CAPTCHA that serves an ISO. In the Overlord chain the VBScript fetches a batch stage with curl (PowerShell as fallback), the batch file requests elevation, adds a Microsoft Defender exclusion and drops CLUpdater.exe into a fake WER folder, scheduled tasks named WindowsErrorReporting and WindowsErrorReportingHourly keep re-running a fake WerFault.exe, and the Go payload decrypts Donut shellcode from werdata.db and calls home to 191.96.225[.]125:5173; an MSI variant installs silently with msiexec and side-loads malicious DLLs through signed ngentask.exe and vlc.exe, beaconing to 45.158.8[.]213:5173. The newdev.dll chain side-loads through VMware’s signed vnetlib.exe, decrypts a Free Pascal RAT (RunAgent export) that sets an HKCU Run key, streams the screen and opens a hidden shell, and connects to 148.224.62[.]243:7777. The objective in all three is hands-on remote control, and Overlord checks for Brazilian banking and fintech apps, so the impact is account takeover and fraud. WatchGuard published no hashes, YARA or Sigma rules, or ATT&CK mapping, so every mapping below is ours; hunt leads, false-positive expectations and indicators are detailed below.

ATT&CK chain: Initial Access → Execution → Privilege Escalation → Defense Evasion → Persistence → Collection → Command and Control

Hunt Lead Grid

C2, Lure Domain and Cloud Bucket Sweep

Overlord RAT emails link to hxxps://<lure-domain>/visualizar-protesto.pdf/cnpj=<number>, where the number is a valid Brazilian company ID, on lookalike notary domains: 1protestorecife[.]com, 2protestodesalvador[.]com, 3protestobelem[.]com, cartorioquintela[.]com, cartoriosdeprotestogo[.]com, protestobh[.]com, protestocampinas[.]com and tabelionatojoinville[.]com, with resolvecenprot[.]com serving the /pdf and /pdfatt/agent777.msi stages. Later stages are pulled from Google Cloud Storage paths storage.googleapis[.]com/protesto-att/ (7seven7.bat, agent.sgn, update.msi, agent.msi, agent777.msi) and storage.googleapis[.]com/win777win/ (777.sgn and update.exe), and from Dropbox. C2 runs on raw ports: 191.96.225[.]125:5173 for the Go payload, 45.158.8[.]213:5173 for the MSI-delivered DLLs, and 148.224.62[.]243:7777 for the newdev.dll RAT. The detection logic is a retrospective sweep of proxy, DNS and firewall logs for any of the ten domains, any URL path containing /protesto-att/ or /win777win/ on storage.googleapis.com, any visualizar-protesto.pdf URL, and any connection to the three IPs on their listed ports.

Use secure web gateway or proxy logs (which see the full GCS path where TLS inspection is in place), DNS resolver logs for the lure domains, email gateway URL logs for the visualizar-protesto.pdf pattern, and firewall or NetFlow for the IP:port pairs. Sweep 90 days, since the source does not date the start of the campaigns and Lampion has run for years. Scope first to finance, accounts-payable and legal staff, who are the natural recipients of notary and invoice lures, and to any Brazil or Portugal offices. Blocking storage.googleapis.com or Dropbox outright is the wrong choice, because legitimate business traffic depends on both; match the bucket paths instead and report the buckets to Google. A click on a lure URL alone is a phishing event; a GCS path fetch or a C2 connection means the script ran and the host should be isolated and swept with the next lead.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1105 (Ingress Tool Transfer) and T1571 (Non-Standard Port); Initial Access → T1566.002 (Phishing: Spearphishing Link) for the lure URLs (our mapping)

Sources: “How VBScript Malware Hides Behind Trusted Tools to Evade Detection”, WatchGuard Secplicity blog, Oct. 22, 2026, https://www.watchguard.com/wgrd-security-hub/secplicity-blog/how-vbscript-malware-hides-behind-trusted-tools-evade-detection (source article)

Fake WER Folder and WindowsErrorReporting Task Sweep

Overlord RAT hides in folders named after Windows Error Reporting. The batch stage copies CLUpdater.exe to C:\ProgramData\Microsoft\Windows\WER\, and CLUpdater.exe creates, or recreates if deleted, scheduled tasks named WindowsErrorReporting and WindowsErrorReportingHourly that repeatedly run WerFault.exe. The Go payload copies itself to WerFault.exe in the user’s Roaming profile under Microsoft\Windows\WER\ (the source writes it as %APPDATA%\Roaming\Microsoft\Windows\WER\WerFault.exe), adds that folder to Defender exclusions, adds a Startup-folder entry, and downloads its encrypted shellcode as werdata.db; it also reads config\settings.json and config\server_index.json. The detection logic is a file and task sweep: any WerFault.exe or CLUpdater.exe outside C:\Windows\System32 and C:\Windows\SysWOW64, any werdata.db file, any scheduled task named WindowsErrorReporting or WindowsErrorReportingHourly whose action points outside System32, and any Startup-folder item that launches a WER-named binary.

Run it with EDR file inventory or a live query across Windows endpoints, the scheduled-task inventory (or Security event 4698 task-creation logs where task auditing is enabled), and Startup-folder listings. Sweep current state and 90 days of task-creation events, because the tasks are recreated and survive reboots. Built-in Windows Error Reporting tasks live under \Microsoft\Windows\Windows Error Reporting\ and run System32 binaries, so check the task’s folder and action path rather than its name alone. Do not hash-block WerFault.exe by name or allowlist it by name either; judge it by path and signer, since the fake is an unsigned Go binary. A hit means an active Overlord infection: isolate, collect the WER folders and the task XML, remove the Defender exclusion, and reset credentials for banking and email used on that host. The path-masquerade check generalizes to any malware that borrows the WER name.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Defense Evasion → T1036.005 (Masquerading: Match Legitimate Resource Name or Location); Persistence → T1053.005 (Scheduled Task/Job: Scheduled Task) and T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder) (our mapping)

Sources: “How VBScript Malware Hides Behind Trusted Tools to Evade Detection”, WatchGuard Secplicity blog, Oct. 22, 2026, https://www.watchguard.com/wgrd-security-hub/secplicity-blog/how-vbscript-malware-hides-behind-trusted-tools-evade-detection (source article)

VBScript Spawning curl or PowerShell Downloads and Defender Exclusions

All three chains start with VBScript run by the user. Overlord’s scripts hide strings with Chr() codes and download Update.exe to Temp with curl, falling back to PowerShell; the batch stage then asks for elevation (one variant through PowerShell RunAs), adds a Microsoft Defender exclusion, and downloads and runs the payload the same way. Lampion’s stage-two VBS arrives from an HTML link and is named Comprovativo_<month>_<day>-<month>-2026-<letters>.vbs, padded with about 5 MB of junk around roughly 5 KB of real code. The newdev.dll chain’s Arquivo.vbs runs from a mounted ISO, decodes WScript.Shell and Scripting.FileSystemObject at runtime, and launches PowerShell and the side-loading executable. The detection logic is a process rule: wscript.exe or cscript.exe running a script from a Downloads, Temp, mail-attachment cache or mounted-volume path that spawns curl.exe, powershell.exe or cmd.exe with a URL argument, plus a separate alert on any Defender exclusion added by a process whose parent chain includes a script host or batch file.

Use EDR process-creation telemetry (or Sysmon event 1) with command lines and parent lineage, and Microsoft Defender configuration-change events for exclusions. Sweep 90 days and then run continuously. Scope to all user workstations; servers rarely run user-launched VBScript at all. Tune by allowlisting known logon and management scripts by their exact network path and signer, not by script name, and treat VBS files over a megabyte or with names matching the Comprovativo_ or COMPROVATIVO- patterns as high-confidence. Disabling Windows Script Host for users who do not need it, or associating .vbs with Notepad, removes this whole entry point and is a better control than tuning. A script host that downloads and then adds a Defender exclusion should go straight to incident response. The rule generalizes to most commodity VBScript and batch loaders.

Hunt Lead Level: 2 (Pro)

ATT&CK: Execution → T1059.005 (Command and Scripting Interpreter: Visual Basic) and T1059.001 (Command and Scripting Interpreter: PowerShell); Command and Control → T1105 (Ingress Tool Transfer); Defense Evasion → T1685 (Disable or Modify Tools) and T1027 (Obfuscated Files or Information) (our mapping)

Sources: “How VBScript Malware Hides Behind Trusted Tools to Evade Detection”, WatchGuard Secplicity blog, Oct. 22, 2026, https://www.watchguard.com/wgrd-security-hub/secplicity-blog/how-vbscript-malware-hides-behind-trusted-tools-evade-detection (source article)

Signed ngentask, VLC and vnetlib Loading DLLs From User-Writable Paths

Overlord’s MSI variant downloads update.msi, agent.msi or agent777.msi with curl or PowerShell and installs it silently with msiexec into an Adobe folder under the user’s Temp directory (the source writes %APPDATA%/Local/Temp/Adobe). Two of the MSIs pair a malicious DLL with a legitimate signed program, the .NET Framework’s ngentask.exe or VLC’s vlc.exe, so the signed program loads the attacker’s DLL, which then connects to 45.158.8[.]213:5173. The newdev.dll ISO ships VMware’s legitimate vnetlib.exe beside a malicious newdev.dll that mimics the real export UpdateDriverForPlugAndPlayDevicesW, adds exports NAeWCAwGNPyCSPsCspAmMjHmmyiQiw and FEpibGGkiLSEccb0hUxnWWcBswPWJP, and XOR-decrypts a Free Pascal DLL whose RunAgent export sets an HKCU Run key pointing back at the signed loader. The detection logic is an image-load rule: ngentask.exe, vlc.exe or vnetlib.exe running from Temp, an Adobe folder under Temp, a mounted ISO or any user-writable directory and loading an unsigned DLL from its own folder, plus msiexec silently installing a package fetched from a cloud storage URL, plus any DLL exporting the two random-looking export names above.

Use EDR image-load and process telemetry (Sysmon events 7 and 1), MSI installer events (Application log, MsiInstaller source) and HKCU Run-key registry events. Sweep 90 days, since the Run key keeps the loader alive. VLC and VMware Workstation are legitimate installs, so allowlist them by their normal Program Files path and the signer of every loaded module, not by the executable name; ngentask.exe belongs under the Windows .NET Framework directory and nowhere else. Hash-blocking these executables is the wrong control: they are unmodified, signed vendor binaries, and blocking them would break real VLC, .NET and VMware installs while the attacker swaps in another host program. A signed binary loading an unsigned same-folder DLL from Temp or an ISO is a strong signal and should be escalated; the rule generalizes to the wider DLL side-loading pattern.

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion → T1574.001 (Hijack Execution Flow: DLL) and T1218.007 (System Binary Proxy Execution: Msiexec); Persistence → T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder) (our mapping)

Sources: “How VBScript Malware Hides Behind Trusted Tools to Evade Detection”, WatchGuard Secplicity blog, Oct. 22, 2026, https://www.watchguard.com/wgrd-security-hub/secplicity-blog/how-vbscript-malware-hides-behind-trusted-tools-evade-detection (source article)

Script to Side-Loaded Binary to Non-Standard Port Beacon

Each chain ends with a process outside the normal install paths talking to a raw TCP port: the Go payload and the MSI-delivered DLLs on port 5173, and the newdev.dll RAT on port 7777, which retries every three seconds when the server does not answer. The RAT’s command set covers remote mouse and keyboard, command and PowerShell execution, file writes, screen streaming (it calls SetProcessDpiAwarenessContext to capture at full resolution), a hidden interactive shell through pipes, and self-removal. The Overlord payload also checks for VMware and VirtualBox folders before running. The detection logic is a sequence correlation per host: a script host, msiexec or ISO mount event, followed within an hour by a new executable or a signed binary running from a user-writable path, followed by that process opening repeated outbound connections to a public IP on a port outside the web and mail set (5173 and 7777 here), with a high-rate retry pattern raising confidence.

This needs EDR process and network telemetry joined on process ID and host, or Sysmon events 1 and 3 in a SIEM, with firewall logs as a fallback for the network leg. Back-test over 90 days and run continuously. Developer workstations legitimately connect to odd ports (local dev servers often use ports in the 5000 range), so exclude internal and loopback destinations and scope the network leg to public IPs, and baseline which processes normally make non-web outbound connections per host role. Blocking only the two ports is the wrong fix, since the operators can move ports; the durable signal is a freshly dropped or side-loaded process beaconing out. Any full-chain hit should be treated as active hands-on access: isolate the host, capture memory (the Overlord and 7seven7.bat stages run shellcode in memory), and review banking and payment activity for affected users. The correlation generalizes to most commodity RATs that use custom TCP protocols.

Hunt Lead Level: 3 (Elite)

ATT&CK: Execution → T1204.002 (User Execution: Malicious File); Command and Control → T1571 (Non-Standard Port) and T1095 (Non-Application Layer Protocol); Collection → T1113 (Screen Capture); Defense Evasion → T1497.001 (Virtualization/Sandbox Evasion: System Checks) and T1620 (Reflective Code Loading) (our mapping)

Sources: “How VBScript Malware Hides Behind Trusted Tools to Evade Detection”, WatchGuard Secplicity blog, Oct. 22, 2026, https://www.watchguard.com/wgrd-security-hub/secplicity-blog/how-vbscript-malware-hides-behind-trusted-tools-evade-detection (source article)

Hash Appendix

No published YARA or Sigma rules: WatchGuard gives detection themes only.

Overlord RAT (VBScript, batch, Go payload, MSI side-loads)

The source article publishes no hashes of any type. An AlienVault OTX lookup could not be completed (OTX search requires an authenticated account), and no VirusTotal records are cited, so every value is marked not available. ngentask.exe and vlc.exe are unmodified legitimate signed binaries: never block their hashes, detect their path and the DLL they load instead.

MD5s

(not available)  # Update.exe / WerFault.exe -> %TEMP%, then the user's Roaming Microsoft\Windows\WER\ (Go payload)
(not available)  # CLUpdater.exe -> C:\ProgramData\Microsoft\Windows\WER\ (task creator)
(not available)  # werdata.db -> Chaskey-encrypted Donut shellcode
(not available)  # 7seven7.bat -> batch loader with embedded Base64 payload
(not available)  # update.msi / agent.msi / agent777.msi -> silent msiexec installs to Temp\Adobe

SHA1s

(not available)  # Update.exe / WerFault.exe -> Go payload
(not available)  # CLUpdater.exe -> C:\ProgramData\Microsoft\Windows\WER\
(not available)  # werdata.db -> encrypted shellcode
(not available)  # 7seven7.bat -> batch loader
(not available)  # update.msi / agent.msi / agent777.msi -> MSI side-load packages

SHA256s

(not available)  # Update.exe / WerFault.exe -> Go payload
(not available)  # CLUpdater.exe -> C:\ProgramData\Microsoft\Windows\WER\
(not available)  # werdata.db -> encrypted shellcode
(not available)  # 7seven7.bat -> batch loader
(not available)  # update.msi / agent.msi / agent777.msi -> MSI side-load packages

newdev.dll campaign (ISO contents)

The source article publishes no hashes; OTX could not be queried unauthenticated. vnetlib.exe is VMware’s unmodified legitimate binary: blocking its hash would break VMware installs, so detect it running from an ISO or user-writable path instead.

MD5s

(not available)  # Arquivo.vbs -> obfuscated VBScript in the ISO
(not available)  # newdev.dll -> malicious side-loaded DLL beside vnetlib.exe
(not available)  # RunAgent DLL -> Free Pascal RAT decrypted in memory

SHA1s

(not available)  # Arquivo.vbs -> obfuscated VBScript in the ISO
(not available)  # newdev.dll -> malicious side-loaded DLL
(not available)  # RunAgent DLL -> Free Pascal RAT

SHA256s

(not available)  # Arquivo.vbs -> obfuscated VBScript in the ISO
(not available)  # newdev.dll -> malicious side-loaded DLL
(not available)  # RunAgent DLL -> Free Pascal RAT

References Appendix

• “How VBScript Malware Hides Behind Trusted Tools to Evade Detection”, WatchGuard Secplicity blog (Euler Neto, WatchGuard Red Cell), Oct. 22, 2026, https://www.watchguard.com/wgrd-security-hub/secplicity-blog/how-vbscript-malware-hides-behind-trusted-tools-evade-detection (source article; all three infection chains, file names, paths, task names, C2 IPs and ports, lure domains, command table)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/