ValleyRAT & Lampion Campaigns: Multi-Vector VBS/HTML Threats Targeting Finance & Global WhatsApp Users

---
title: Potential ValleyRAT or Gh0st RAT VBS Execution via WhatsApp
id: 88a31f56-1234-5678-9101-1234567890ab
description: Detects the execution of VBS scripts initiated by WhatsApp or other communication apps, indicative of the active ValleyRAT/gh0st RAT distribution campaign.
status: experimental
date: 2026/07/22
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/660d8a2b7f1e4f0a8c9d0e1f2a3b4c5d/
tags:
    - attack.execution
    - attack.t1059.005
    - attack.initial_access
    - malware.valleyrat
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\WhatsApp.exe'
            - '\WhatsAppDesktop.exe'
        Image|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
        CommandLine|contains: '.vbs'
    condition: selection
falsepositives:
    - Legitimate administrative scripts run by users
level: high
---
title: Lampion/ChePro Obfuscated HTML Script Execution
id: 99b42e67-2345-6789-0123-2345678901bc
description: Detects execution of mshta.exe or wscript.exe spawned by a browser or email client, common in the Lampion banking trojan infection chain involving HTML droppers.
status: experimental
date: 2026/07/22
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/771e9b3c8f2e5g1h9i0j2k3l4m5n6o7p/
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1059.005
    - malware.lampion
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\mshta.exe'
            - '\wscript.exe'
    selection_parent:
        ParentImage|contains:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
            - '\outlook.exe'
    condition: all of selection_*
falsepositives:
    - Web-based SaaS applications utilizing local scripts
level: high
---
title: Suspicious ManageEngine Endpoint Central Exploitation Activity
id: aac53f78-3456-7890-1234-3456789012cd
description: Detects suspicious command line arguments associated with ManageEngine Endpoint Central exploitation, often used by ValleyRAT for UAC bypass and lateral movement.
status: experimental
date: 2026/07/22
author: Security Arsenal
tags:
    - attack.privilege_escalation
    - attack.t1068
    - attack.defense_evasion
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|contains: 'ManageEngine'
        CommandLine|contains:
            - 'ping'
            - 'nslookup'
            - 'whoami'
            - 'net user'
    condition: selection
falsepositives:
    - Legitimate administrative troubleshooting via the tool
level: medium


kql
// Hunt for IOCs and Script Execution Behavior (Microsoft Sentinel)
// Check for specific file hashes and suspicious script execution
let MaliciousHashes = dynamic([
  "02bb20455cc592a69c080abac770ce90", "31037a42ca048e06e69a78f55bc2eff5",
  "887ec87e4a19759cad25d4bc0956d2b965d3041d", "f0fde01b1e36503227252f6cb6b3b075f93a2c1a",
  "452259dc297f56cf22c7932e8fbcefe821ef9c3127134074fae585f89355d397",
  "50c74b468c217776b8890b841baefec8b196b14083a7873a9201c838a8e4c90a",
  "036c8f32012abdcb9a389ae9c284da89505e830bca74eb1aa9ea3794b067aab6",
  "050e84d134a32ed7c4885a9d57ce37f8ae5f910960b67e2156941961bd5781ba"
]);
// 1. File Creation Events matching Malicious Hashes
DeviceFileEvents
| where SHA256 in (MaliciousHashes) or MD5 in (MaliciousHashes) or SHA1 in (MaliciousHashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName, InitiatingProcessFileName
| union (
  // 2. Process Creation Events for Script Interpreters (VBS/HTA)
  DeviceProcessEvents
  | where FileName in ("wscript.exe", "cscript.exe", "mshta.exe")
  | where ProcessCommandLine has ".vbs" or ProcessCommandLine has ".hta" or ProcessCommandLine has ".html"
  | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
)


powershell
# IOC Hunt Script for ValleyRAT, Gh0st RAT, and Lampion
# Requires Administrator Privileges for system-wide scan

$TargetHashes = @(
    "02bb20455cc592a69c080abac770ce90", "31037a42ca048e06e69a78f55bc2eff5",
    "887ec87e4a19759cad25d4bc0956d2b965d3041d", "f0fde01b1e36503227252f6cb6b3b075f93a2c1a",
    "452259dc297f56cf22c7932e8fbcefe821ef9c3127134074fae585f89355d397",
    "50c74b468c217776b8890b841baefec8b196b14083a7873a9201c838a8e4c90a",
    "05d188f071d097f5b6bd8138749b4b14", "0ba93109757776a44de9d8c88baa4963",
    "036c8f32012abdcb9a389ae9c284da89505e830bca74eb1aa9ea3794b067aab6",
    "050e84d134a32ed7c4885a9d57ce37f8ae5f910960b67e2156941961bd5781ba",
    "1541c23f34eb05dfcbede3830741427681d719cee1dfd397a2c04110e0fa81b2",
    "1bd347ce5deee3d783a038e2d2d224bc30cc074e0471a3897c5409ce99816dc9"
)

$SearchPaths = @("C:\Users\", "C:\ProgramData\", "C:\Windows\Temp")

Write-Host "[+] Starting IOC Hunt for ValleyRAT/Gh0st/Lampion components..." -ForegroundColor Cyan

foreach ($Path in $SearchPaths) {
    if (Test-Path $Path) {
        Write-Host "[+] Scanning $Path ..." -ForegroundColor Yellow
        try {
            Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
                $FileHash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
                if ($TargetHashes -contains $FileHash) {
                    Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
                    # Optional: Quarantine logic here
                }
                # Check SHA256 as well for completeness
                $FileHash256 = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
                if ($TargetHashes -contains $FileHash256) {
                    Write-Host "[!] MALICIOUS FILE FOUND (SHA256): $($_.FullName)" -ForegroundColor Red
                }
            }
        }
        catch {
            Write-Host "[-] Error accessing $Path : $_" -ForegroundColor Gray
        }
    }
}

Write-Host "[+] Hunt Complete." -ForegroundColor Green