VBScript Downloader with Install-Date Check and Public Folder Staging

Ibrahim Saud@tektrix

•updated Sep 23, 2026•1•0•3

Detects VBScript files that exhibit characteristics of a downloader or dropper, including common Windows API usage (WScript.Shell, Shell.Application, MSXML2.XMLHTTP, ADODB.Stream), staging in the C:\Users\Public\ directory, and performing sandbox evasion via WMI InstallDate checks.