Procedure examples

Xbash can execute malicious VBScript payloads on the victim’s machine.

DarkGate initial infection mechanisms include masquerading as pirated media that launches malicious VBScript on the victim.

NanHaiShu executes additional VBScript code on the victim's machine.

SVCReady has used VBA macros to execute shellcode.

Ferocious has the ability to use Visual Basic scripts for execution.

Saint Bot has used `.vbs` scripts for execution.

Chaes has used VBscript to execute malicious code.

TYPEFRAME has used a malicious Word document for delivery with VBA macros for execution.

QUADAGENT uses VBScripts.

Metamorfo has used VBS code on victims’ systems.

Bandook has used malicious VBA code against the target system.

Kerrdown can use a VBS base64 decoder function published by Motobit.

VBShower has the ability to execute VBScript files.

StoneDrill has several VBS scripts used throughout the malware's lifecycle.

OopsIE creates and uses a VBScript as part of its persistent execution.

Grandoreiro can use VBScript to execute malicious code.

Sibot executes commands using VBScript.

LunarMail has been installed using a VBA macro.

Cobalt Strike can use VBA to perform execution.

SUNBURST used VBScripts to initiate the execution of payloads.

JCry has used VBS scripts.

REvil has used obfuscated VBA macros for execution.

OSX_OCEANLOTUS.D uses Word macros for execution.

NanoCore uses VBS files.

IPsec Helper can run arbitrary Visual Basic scripts and commands passed to it.

DanBot can use a VBA macro embedded in an Excel file to drop the payload.

Ramsay has included embedded Visual Basic scripts in malicious documents.

BackConfig has used VBS to install its downloader component and malicious documents with VBA macro code.

LookBack has used VBA macros in Microsoft Word attachments to drop additional files to the host.

Lokibot has used VBS scripts and XLS macros for execution.

PoetRAT has used Word documents with VBScripts to execute malicious activities.

BabyShark can execute additional VisualBasic content.

Melcoz can use VBS scripts to execute malicious DLLs.

KOCTOPUS has used VBScript to call wscript to execute a PowerShell command.

STARWHALE can use the VBScript function `GetRef` as part of its persistence mechanism.

POWERSTATS can use VBScript (VBE) code for execution.

Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.

Remexi uses AutoIt and VBS scripts throughout its execution process.

Astaroth has used malicious VBS e-mail attachments for execution.

QakBot can use VBS to download and execute malicious files.

jRAT has been distributed as HTA files with VBScript.

One version of Helminth consists of VBScript scripts.

Comnie executes VBS scripts.

JSS Loader can download and execute VBScript files.

Remcos can execute VBS remotely.

Donut can generate shellcode outputs that execute via VBScript.

Koadic performs most of its operations using Windows Script Host (VBScript) and runs arbitrary shellcode .

reGeorg is a Python-based web shell.

InvisibleFerret is written in Python and has used Python scripts for execution.

UPSTYLE is a Python-based application.