Technique:  Command and Scripting Interpreter:Visual Basic
During the 2015 Ukraine Electric Power Attack, It installed a VBA script called vba_macro.exe. This macro dropped FONTCACHE.DAT, the primary BlackEnergy implant; rundll32.exe, for executing the malware; NTUSER.log, an empty file; and desktop.ini, the default file used to determine folder displays on Windows machines.
During the 2016 Ukraine Electric Power Attack, It created VBScripts to run on an SSH server.
It has embedded a VBScript within a malicious Word document which is executed upon the document opening.
It has used macros, COM scriptlets, and VBS scripts.
It has used VBScript to initiate the delivery of payloads.
It executes shellcode and a VBA script to decode Base64 strings.
It has used VBScript to execute commands and other operational tasks.
It has utilized malicious VBS scripts in malware.
Astaroth has used malicious VBS e-mail attachments for execution.
BackConfig has used VBS to install its downloader component and malicious documents with VBA macro code.
Bandook has used malicious VBA code against the target system.
Bisonal's dropper creates VBS scripts on the victim’s machine.
It has used VBS and VBE scripts for execution.
Bumblebee can create a Visual Basic script to enable persistence.
For C0011, It used malicious VBA macros within a lure document as part of the Crimson malware installation process onto a compromised host.
During C0015, the threat actors used a malicious HTA file that contained a mix of HTML and JavaScript/VBScript code.
Chaes has used VBscript to execute malicious code.
It has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.
Cobalt Strike can use VBA to perform execution.
Comnie executes VBS scripts.
It has used VBScript to execute malicious code.
DanBot can use a VBA macro embedded in an Excel file to drop the payload.
Donut can generate shellcode outputs that execute via VBScript.
It used VBA scripts.
Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads.
Exaramel for Windows has a command to execute VBS scripts on the victim’s machine.
Ferocious has the ability to use Visual Basic scripts for execution.
It has used VBS scripts for code execution on comrpomised machines.
It has used VBA macros to display a dialog box and collect victim credentials.
It used VBS scripts to help perform tasks on the victim's machine.
Flagpro can execute malicious VBA macros embedded in .xlsm files.
During Frankenstein, the threat actors used Word documents that prompted the victim to enable macros and run a Visual Basic script.
During FunnyDream, the threat actors used a Visual Basic script to run remote commands.
It has embedded malicious macros in document templates, which executed VBScript. It has also delivered Microsoft Outlook VBA projects with embedded macros.
Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.
It has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.
Grandoreiro can use VBScript to execute malicious code.
One version of Helminth consists of VBScript scripts.
It has used a VisualBasic script named MicrosoftUpdator.vbs for execution of a PowerShell keylogger.
It has used VBScript code on the victim's machine.
IcedID has used obfuscated VBA string expressions.
It has used VBScript to execute malicious commands and payloads.
Javali has used embedded VBScript to download malicious payloads from C2.
JCry has used VBS scripts.
jRAT has been distributed as HTA files with VBScript.
JSS Loader can download and execute VBScript files.
Kerrdown can use a VBS base64 decoder function published by Motobit.
KeyBoy uses VBS scripts for installing files and performing execution.
It has used Visual Basic to download malicious payloads. It has also used malicious VBA macros within maldocs disguised as forms that trigger when a victim types any content into the lure.
Koadic performs most of its operations using Windows Script Host (VBScript) and runs arbitrary shellcode .
KOCTOPUS has used VBScript to call wscript to execute a PowerShell command.
It has used VBA and embedded macros in Word documents to execute malicious code.
It has used VBScript to execute malicious code.
It has used VBScript.
Lokibot has used VBS scripts and XLS macros for execution.
LookBack has used VBA macros in Microsoft Word attachments to drop additional files to the host.
It has embedded malicious macros within spearphishing attachments to download additional files.
It malware has used VBS scripts for execution.
Melcoz can use VBS scripts to execute malicious DLLs.
Metamorfo has used VBS code on victims’ systems.
It used various implants, including those built with VBScript, on target machines.
It has used VBScript files to execute its POWERSTATS payload, as well as macros.
It has embedded VBScript components in LNK files to download additional files and automate collection.
NanHaiShu executes additional VBScript code on the victim's machine.
NanoCore uses VBS files.
NETWIRE has been executed through use of VBScripts.
It has used VBSscipt macros for execution on compromised hosts.
OopsIE creates and uses a VBScript as part of its persistent execution.
During Operation CuckooBees, the threat actors executed an encoded VBScript file using wscript and wrote the decoded output to a text file.
During Operation Dream Job, It executed a VBA written malicious macro after victims download malicious DOTM files; It also used Visual Basic macro code to extract a double Base64 encoded DLL implant.
During Operation Dust Storm, the threat actors used Visual Basic scripts.
For Operation Honeybee, the threat actors used a Visual Basic script embedded within a Word document to download an implant.
During Operation Sharpshooter, the threat actors used a VBA macro to execute a simple downloader that installed Rising Sun.
During Operation Wocao, threat actors used VBScript to conduct reconnaissance on targeted systems.
OSX_OCEANLOTUS.D uses Word macros for execution.
It used Visual Basic Scripts (VBS) on victim machines.
PoetRAT has used Word documents with VBScripts to execute malicious activities.
PowerShower has the ability to save and execute VBScript.
POWERSTATS can use VBScript (VBE) code for execution.
Pteranodon can use a malicious VBS file for execution.
QakBot can use VBS to download and execute malicious files.
QUADAGENT uses VBScripts.
Ramsay has included embedded Visual Basic scripts in malicious documents.
It has used VBS scripts as well as embedded macros for execution.
Remexi uses AutoIt and VBS scripts throughout its execution process.
REvil has used obfuscated VBA macros for execution.
ROKRAT has used Visual Basic for execution.
Saint Bot has used .vbs scripts for execution.
It has created VBScripts to run an SSH server.
Sibot executes commands using VBScript.
It has sent Microsoft Office Publisher documents to victims that have embedded malicious macros that execute an hta file via calling mshta.exe.
It has used VBScript to drop and execute malware loaders.
It has used VBS scripts.
Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload.
Snip3 can use visual basic scripts for first-stage execution.
For the SolarWinds Compromise, It wrote malware such as Sibot in Visual Basic.
Squirrelwaffle has used malicious VBA macros in Microsoft Word documents and Excel spreadsheets that execute an AutoOpen subroutine.
STARWHALE can use the VBScript function GetRef as part of its persistence mechanism.
StoneDrill has several VBS scripts used throughout the malware's lifecycle.
SUNBURST used VBScripts to initiate the execution of payloads.
SVCReady has used VBA macros to execute shellcode.
It has used VBS files to execute or establish persistence for additional payloads, often using file names consistent with email themes or mimicking system functionality.
It has a VBScript for execution.
It has used VBS for code execution.
It has crafted VBS-based malicious documents.
It has used VBS scripts throughout its operations.
TYPEFRAME has used a malicious Word document for delivery with VBA macros for execution.
Ursnif droppers have used VBA macros to download and execute the malware's full executable payload.
VBShower has the ability to execute VBScript files.
WhisperGate can use a Visual Basic script to exclude the C:\ drive from Windows Defender.
It has used Visual Basic 6 (VB6) payloads.
It has used VBScript  in its operations.
Xbash can execute malicious VBScript payloads on the victim’s machine.