From Email to RAT: Deciphering a VBS Script-Driven Campaign

Authored by Preksha Saxena and Yashvi Shah

McAfee Labs has been tracking a sophisticated VBS campaign characterized by obfuscated Visual Basic Scripting (VBS). Initially delivering the AgentTesla malware, the campaign has evolved into a multi-faceted threat, employing VBS scripts as a versatile delivery mechanism. Notably, this campaign extends beyond AgentTesla, now distributing a range of malware such as Guloader, Remcos RAT, Xworm, and Lokibot.

This campaign illustrates a comprehensive infection process initiated by a VBS file delivered via email. Starting …

agenttesla basic beyond campaign delivery email labs malware mcafee mechanism obfuscated rat script scripting scripts threat tracking vbs visual basic