Rundll32 Execution of Lampion RAT via jangadeiro Export from AppData

Luís Marques@remotecodeexecution

•updated Jul 23, 2026•5•0•2

Detects the execution of rundll32.exe from the AppData directory with a specific command-line argument 'jangadeiro'. This behavior is characteristic of the Lampion RAT, which uses rundll32.exe to proxy execution of its malicious DLL component stored within structured subdirectories in the user's AppData folder.