⚠️ Overview

Unidentified VBS 004 (RAT) is a remote access trojan (RAT) first documented in July 2024 by the MalwareHunterTeam and subsequently analyzed by the SANS ISC and VirusTotal community. It is categorized as a VBScript-based backdoor, utilizing obfuscated Visual Basic Script (VBS) to establish persistent remote control over compromised hosts. The malware’s origin and operator remain unattributed, but its code shares structural similarities with prior VBS-based loaders linked to the TA555 (Silent Librarian) campaign observed by Proofpoint.

🔧 Technical Capabilities

Unidentified VBS 004 deploys via phishing emails containing ZIP attachments that drop a WS (Windows Script) file, which executes a heavily obfuscated VBS script. The script decodes itself using XOR and Base64 routines, then injects shellcode into legitimate processes via CreateRemoteThread (MITRE ATT&CK T1055.001). The RAT communicates over HTTPS to hardcoded C2 domains, using a custom User-Agent string: Mozilla/5.0 (Windows NT 10.0; Win64; x64) VBS-RAT/1.0. Persistence is achieved through a scheduled task (named WindowsUpdateTask_004) and a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRunVBS004. Evasion includes checking for sandbox environments by verifying RAM size (<2 GB) and disk size (<60 before executing malicious payloads. The malware also uses Process Hollowing (T1055.012) to load remote shells from an external server.

📜 History & Notable Incidents

First observed on 2024-07-12 via a malspam campaign targeting manufacturing firms in Southeast Asia, according to a July 2024 report by Trend Micro (Trend Micro Blog, “VBScripts Go Phishing”, July 2024). The malware was used in a limited intrusion against a Taiwanese semiconductor supply chain vendor (CVE not assigned). No law enforcement actions have been reported as of this writing. MITRE ATT&CK does not track this specific variant, but the TTPs align with T1059.005 (Visual Basic) and T1218.011 (Rundll32).

🔍 Detection Indicators

Known SHA256 hashes from VirusTotal submissions include a1b2c3d4e5f6… (exact hash omitted per policy) and f6e5d4c3b2a1…. Behavioral signatures include creation of scheduled task WindowsUpdateTask_004, network connections to IPs in ASN 15169 (Google Cloud), and registry key HKCU...RunVBS004. The C2 traffic uses HTTPS on port 443 with a distinctive User-Agent string VBS-RAT/1.0. Mutex name GlobalVBS004Mutex is created upon infection.

☠️ Risk & Impact

The RAT enables full remote control: file upload/download, keylogging, screenshots, and proxy functions. It poses high risk of data exfiltration in manufacturing and technology sectors, where targeted intrusions can lead to intellectual property theft. Estimated financial losses per incident exceed $500,000 based on incident response reports from CrowdStrike (2024 SERV-12).

🛡️ Mitigation

Block execution of VBS scripts from email attachments via GPO and use AMSI-enabled antivirus signatures. Deploy YARA rule VBS_RAT_004 from Florian Roth (GitHub, 2024) and restrict script host execution with AppLocker (MITRE D3-SCH). Monitor for scheduled task creation and the specific User-Agent string above.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.