Malicious
klagent.vbs
VBScript
MD5: e2d4a4e3f28426492467bdb1864a9197
Size: 81.66 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
81.66 KB · 81,655 B
First seen
2026-08-14 09:19 · 2 months ago
Last seen
2026-08-14 09:19 · 2 months ago
Last analysis
2026-08-15 11:20 · 2 months ago
Hashes
MD5
e2d4a4e3f28426492467bdb1864a9197
Sha1
6396d1b80ae1a0000ed15b7f4de89b3d9842b049
Sha256
4373f2e173e781143b28a598a8cc552174ecc508a8267f3d318c14021d0cf442
Sha384
efe0722013bd5315d7b2a44fdcb5e1cd4d4c4d6a78b9fa3f8830a2377fa1c471687e2e512b1cbaa4c5df920bcf61ca0b
Sha512
c07f0679dfd0546b276cabefc70faa879aeb366a61ec46c1d6393ff6f251e6bdda4fd47e3686733cb0db237edcce83586da26bd3844b7d2b71bf03b78c4ed631
SSDeep
1536:cOIRDR8/Rro1+fSSt0oQOLBi93KN7kw9FS60NEWQcKC+pcWctrF60GWABd8gcsEZ:cOIRDR8/RrY+fSSt0oQOLBi93KN7kw9y
TLSH
95839FFD0CDDDBA23FD6E0420F3D235055188EC7E2F9E9B7285B5A801B6790815875AB
2 malicious · 2 files
VBSklagent.vbsT1027 · T1059.005
VBSklagent.vbs.deobfuscated.vbsT1059.005
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059.005
Shape
scr:vbs
malicious
1 nodes
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential2 malicious · 2 files
VBSklagent.vbsT1027 · T1059.005
VBSklagent.vbs.deobfuscated.vbsT1059.005
No malware configuration was found at this point.
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
klagent.vbs
URLs in VB Code - #2
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
klagent.vbs
URLs in VB Code - #3
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
klagent.vbs
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account