value:  Bisonal's dropper creates VBS scripts on the victim’s machine. ;; BRONZE BUTLER has used VBS and VBE scripts for execution. ;; Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution. ;; Cobalt Strike can use VBA to perform execution. ;; Comnie executes VBS scripts. ;; Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads. ;; Exaramel for Windows has a command to execute VBS scripts on the victim’s machine. ;; FIN4 has used VBA macros to display a dialog box and collect victim credentials. ;; FIN7 used VBS scripts to help perform tasks on the victim's machine. ;; Frankenstein has used Word documents that prompts the victim to enable macros and run a Visual Basic script. ;; Gamaredon Group has embedded malicious macros in document templates which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros. ;; Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2. ;; Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines. ;; Grandoreiro can use VBScript to execute malicious code. ;; One version of Helminth consists of VBScript scripts. ;; Higaisa has used VBScript code on the victim's machine. ;; Honeybee embeds a Visual Basic script within a malicious Word document as part of initial access; the script is executed when the Word document is opened. ;; IcedID has used obfuscated VBA string expressions. ;; Inception has used VBScript to execute malicious commands and payloads. ;; Javali has used embedded VBScript to download malicious payloads from C2. ;; JCry has used VBS scripts. ;; jRAT has been distributed as HTA files with VBScript. ;; KeyBoy uses VBS scripts for installing files and performing execution. ;; Kimsuky has used Visual Basic to download malicious payloads. ;; Koadic performs most of its operations using Windows Script Host (VBScript) and runs arbitrary shellcode . ;; Lazarus Group has used VBScript to gather information about a victim machine. ;; Leviathan has used VBScript. ;; LookBack has used VBA macros in Microsoft Word attachments to drop additional files to the host. ;; Machete has embedded malicious macros within spearphishing attachments to download additional files. ;; Magic Hound malware has used VBS scripts for execution. ;; Melcoz can use VBS scripts to execute malicious DLLs. ;; Metamorfo has used VBS code on victims’ systems. ;; Molerats used various implants including those built with VBScript on target machines. ;; MuddyWater has used VBScript files to execute its POWERSTATS payload as well as macros. ;; Mustang Panda has embedded VBScript components in LNK files to download additional files and automate collection. ;; NanHaiShu executes additional VBScript code on the victim's machine. ;; NanoCore uses VBS files. ;; NETWIRE has been executed through use of VBScripts. ;; OopsIE creates and uses a VBScript as part of its persistent execution. ;; Operation Wocao has used a VBScript to conduct reconnaissance on targeted systems. ;; OSX_OCEANLOTUS.D uses Word macros for execution. ;; Patchwork used Visual Basic Scripts (VBS) on victim machines. ;; PoetRAT has used Word documents with VBScripts to execute malicious activities. ;; PowerShower has the ability to save and execute VBScript. ;; POWERSTATS can use VBScript (VBE) code for execution. ;; QUADAGENT uses VBScripts. ;; Ramsay has included embedded Visual Basic scripts in malicious documents. ;; Rancor has used VBS scripts as well as embedded macros for execution. ;; Remexi uses AutoIt and VBS scripts throughout its execution process. ;; REvil has used obfuscated VBA macros for execution. ;; Sandworm Team has created VBScripts to run an SSH server. ;; Sharpshooter's first-stage downloader was a VBA macro. ;; Sibot executes commands using VBScript. ;; Sidewinder has used VBScript to drop and execute malware loaders. ;; Silence has used VBS scripts. ;; Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload. ;; StoneDrill has several VBS scripts used throughout the malware's lifecycle. ;; SUNBURST used VBScripts to initiate the execution of payloads. ;; TA459 has a VBScript for execution. ;; TA505 has used VBS for code execution. ;; Turla has used VBS scripts throughout its operations. ;; TYPEFRAME has used a malicious Word document for delivery with VBA macros for execution. ;; Ursnif droppers have used VBA macros to download and execute the malware's full executable payload. ;; VBShower has the ability to execute VBScript files. ;; Windshift has used Visual Basic 6 (VB6) payloads. ;; WIRTE has used VBS scripts throughout its operation. ;; Xbash can execute malicious VBScript payloads on the victim’s machine.;;archive contains malicious BornSlippy VBScript (VBS) files that attempt to write a DLL file to disk and execute it using rundll32.exe ;; WMIEXEC is a lightweight backdoor written in VBScript that uses WMI to execute shell commands or create a reverse shell on a remote system ;; RATDispenser malware decodes itself and launches a stand-alone VBScript, which then installs a remote access Trojan on the infected device 
name: Command and Scripting Interpreter: Visual Basic