Procedure examples

LookBack has used VBA macros in Microsoft Word attachments to drop additional files to the host.

Lokibot has used VBS scripts and XLS macros for execution.

PoetRAT has used Word documents with VBScripts to execute malicious activities.

BabyShark can execute additional VisualBasic content.

Melcoz can use VBS scripts to execute malicious DLLs.

KOCTOPUS has used VBScript to call wscript to execute a PowerShell command.

STARWHALE can use the VBScript function `GetRef` as part of its persistence mechanism.

POWERSTATS can use VBScript (VBE) code for execution.

Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.

Remexi uses AutoIt and VBS scripts throughout its execution process.

Astaroth has used malicious VBS e-mail attachments for execution.

QakBot can use VBS to download and execute malicious files.

jRAT has been distributed as HTA files with VBScript.

One version of Helminth consists of VBScript scripts.

Comnie executes VBS scripts.

JSS Loader can download and execute VBScript files.

Remcos can execute VBS remotely.

Donut can generate shellcode outputs that execute via VBScript.

Koadic performs most of its operations using Windows Script Host (VBScript) and runs arbitrary shellcode .