Procedure examples

Bumblebee can create a Visual Basic script to enable persistence.

Exaramel for Windows has a command to execute VBS scripts on the victim’s machine.

Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload.

TAMECAT has used VBScript to query anti-virus products.

Ursnif droppers have used VBA macros to download and execute the malware's full executable payload.

NETWIRE has been executed through use of VBScripts.

Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads.

SystemBC has leveraged VBScript to execute malicious code.

Squirrelwaffle has used malicious VBA macros in Microsoft Word documents and Excel spreadsheets that execute an `AutoOpen` subroutine.

ShrinkLocker is a VisualBasic script (VBS) object that calls multiple other operating system functions during execution.

Snip3 can use visual basic scripts for first-stage execution.

WhisperGate can use a Visual Basic script to exclude the `C:\` drive from Windows Defender.

Mispadu’s dropper uses VBS files to install payloads and perform execution.

IcedID has used obfuscated VBA string expressions.

PowerShower has the ability to save and execute VBScript.

CHIMNEYSWEEP has executed a script named cln.vbs on compromised hosts.

Flagpro can execute malicious VBA macros embedded in .xlsm files.

KeyBoy uses VBS scripts for installing files and performing execution.

Pteranodon can use a malicious VBS file for execution.

ROKRAT has used Visual Basic for execution.

Javali has used embedded VBScript to download malicious payloads from C2.

Bisonal's dropper creates VBS scripts on the victim’s machine.

Xbash can execute malicious VBScript payloads on the victim’s machine.

DarkGate initial infection mechanisms include masquerading as pirated media that launches malicious VBScript on the victim.

NanHaiShu executes additional VBScript code on the victim's machine.

SVCReady has used VBA macros to execute shellcode.

Ferocious has the ability to use Visual Basic scripts for execution.

Saint Bot has used `.vbs` scripts for execution.

Chaes has used VBscript to execute malicious code.

TYPEFRAME has used a malicious Word document for delivery with VBA macros for execution.

QUADAGENT uses VBScripts.

Metamorfo has used VBS code on victims’ systems.

Bandook has used malicious VBA code against the target system.

Kerrdown can use a VBS base64 decoder function published by Motobit.

VBShower has the ability to execute VBScript files.

StoneDrill has several VBS scripts used throughout the malware's lifecycle.

OopsIE creates and uses a VBScript as part of its persistent execution.

Grandoreiro can use VBScript to execute malicious code.

Sibot executes commands using VBScript.

LunarMail has been installed using a VBA macro.

Cobalt Strike can use VBA to perform execution.

SUNBURST used VBScripts to initiate the execution of payloads.

JCry has used VBS scripts.

REvil has used obfuscated VBA macros for execution.

OSX_OCEANLOTUS.D uses Word macros for execution.

NanoCore uses VBS files.

IPsec Helper can run arbitrary Visual Basic scripts and commands passed to it.

DanBot can use a VBA macro embedded in an Excel file to drop the payload.

Ramsay has included embedded Visual Basic scripts in malicious documents.

BackConfig has used VBS to install its downloader component and malicious documents with VBA macro code.