Trusted VLC and VMware Binaries Abused to Side-Load Malware in Brazil and Portugal
Attackers are turning legitimate Windows software into a delivery vehicle. In three separate campaigns aimed at users in Brazil and Portugal, signed executables from VLC Media Player, VMware and the Microsoft .NET Framework were used to load malicious libraries, giving the operators a trusted-looking process to hide behind.
The technique is DLL side-loading. Rather than tampering with a well-known program, the attacker drops a malicious DLL into the same folder and lets the program load it on start-up. The executable passes every reputation check; the library beside it does the damage.
What happened
Overlord RAT (Brazil). The first campaign begins with phishing emails that pose as Brazilian notary offices and warn the recipient about a pending "protest" filed against their company. The lure points to a supposed legal document, but the download is a VBScript that fetches an executable or a Windows Installer (MSI) package. The scripts hide their logic by assembling strings from character codes at run time.
Two of the installers in this chain use side-loading. One pairs the malicious library with a genuine .NET Framework utility (ngentask.exe); the other ships a copy of VLC Media Player. Both unpack into a temporary folder named "Adobe". Follow-on stages pull extra files from Dropbox and Google Cloud Storage, add Microsoft Defender exclusions through PowerShell, and register scheduled tasks named "Windows Error Reporting" that launch a loader masquerading as WerFault.exe. Encrypted data recovered from the chain decoded into Donut shellcode, which runs the final payload entirely in memory.
VMware-based chain (Portugal). The next campaign starts on a Portuguese-language page promising a "secure invoice download". A fake CAPTCHA hands the visitor an ISO image. Inside are an obfuscated VBScript, a legitimate VMware network-installation utility (vnetlib.exe), a malicious newdev.dll and a module-definition file. The VMware binary is only the loader: the DLL XOR-decrypts an embedded 64-bit library written in Pascal, which is the real remote-access tool.
That Pascal payload is full-featured. It can drive the mouse and keyboard, run commands through PowerShell or CMD, write files, stream the screen and open hidden interactive shells. It can also uninstall itself and clean up its traces. If the command-and-control server is unreachable, it retries every three seconds, a behaviour that stands out in network telemetry.
Lampion (Portugal). The third campaign is a fresh wave of the Lampion banking malware, delivered through finance-themed phishing with ZIP attachments named like Portuguese payment receipts ("COMPROVATIVO_…"). Its scripts are padded to roughly 5 MB while the working code is only around 5 KB, a cheap trick that defeats size-based filtering and slows down analysis.
The three operations share delivery habits and a curious fondness for the number seven in file and folder names, but there is no evidence that a single group runs all of them. Treat them as related tradecraft, not a confirmed single actor.
Why it matters
Side-loading defeats the instinct to judge a process by its executable. Antivirus allow-lists, application-control policies and even a human analyst looking at a process tree will see vlc.exe or a VMware tool and move on. The malicious code lives in a library the process loaded, from a folder it should never have loaded anything from.
The same chains also show how several individually harmless Windows actions add up to a compromise: a script download, a Defender exclusion, a scheduled task, a trusted binary loading a DLL from a temp folder. Each one, in isolation, is noise. Together they are an intrusion.
Indicators to hunt for
Values are defanged on purpose; re-fang them only inside your SIEM or threat-intelligence platform.
| Type | Indicator | Context |
|---|---|---|
| C2 address | 191[.]96[.]225[.]125 (port 5173) | Overlord RAT infrastructure |
| C2 address | 45[.]158[.]8[.]213 (port 5173) | Overlord RAT, side-loaded DLLs |
| C2 address | 148[.]224[.]62[.]243 (port 7777) | Pascal payload, 3-second retry loop |
| Phishing domains | protestorecife[.]com, protestobh[.]com, protestocampinas[.]com, cartoriosdeprotestogo[.]com, tabelionatojoinville[.]com | Notary-office impersonation |
| Abused executables | vlc.exe, ngentask.exe, vnetlib.exe | Legitimate loaders |
| Malicious files | newdev.dll, Arquivo.vbs, downloader.bat, 7seven7.bat, werdata.db | Scripts and payload containers |
| Paths | %APPDATA%\Local\Temp\Adobe, C:\ProgramData\Microsoft\Windows\WER | Side-loading and install directories |
| Scheduled task | Windows Error Reporting | Persistence created by CLUpdater.exe |
| Embedded string | OVERLORD-SECURE-LOG | Overlord RAT key |
No file hashes are available for these chains at this time, so none are listed.
What to do
- Alert on trusted binaries loading libraries from user-writable folders. VLC, VMware tools and .NET utilities have no reason to run from
%TEMP%or a folder called "Adobe". Sysmon image-load events (Event ID 7) make this visible. - Treat new Defender exclusions as incidents, not configuration changes. Monitor
Set-MpPreferenceandAdd-MpPreferenceexecutions launched from scripts. - Review scheduled tasks created outside your deployment tooling, especially ones that borrow Windows component names.
- Correlate, don't triage alerts one by one. A script download followed by an exclusion and a scheduled task within minutes is a chain, not three low-priority tickets.
- Block or sandbox ISO and VBScript attachments at the mail gateway, and brief finance and legal staff in Portuguese-speaking offices on the notary and invoice lures.
- Hunt the indicators above across endpoint and proxy logs, and isolate any host that matches.
Chains like these succeed because nobody has tested whether the environment would actually stop them. Our penetration testing engagements include exactly this kind of assumed-breach exercise: we check whether a side-loaded library, a scripted Defender exclusion or a renamed scheduled task would be caught by your controls before an attacker finds out for you.