VBS/Adodb.D whats up with this trojan loader?

[phunnypot]

Payload Title

USB Rubberducky-payloads

Payload URL

https://github.com/hak5/usbrubberducky-payloads/i

Payload Setup

av caught this trojan loader Adoob.D

Problem Description

Whats this about?

Troubleshooting steps

It wont download

Suspected Cause

Someone being sneaky?

Screenshots or additional information

No response

Checklist ✅ - READ CAREFULLY

• I checked and didn't find a similar issue already reported
• I am using PayloadStudio to encode this payload
• I made sure to redact any private information in the details shared above
• I have read and followed the documentation provided by the original payload author and configured the payload (if required)
• I have confirmed I am deploying this payload with the correct device intended by the original author (Original USB Rubber Ducky vs New USB Rubber Ducky)
• I have confirmed I am deploying this payload on the correct target host intended by the original author (Windows, Mac, Linux, etc)
• I have confirmed the payload is compiled in the correct keyboard language for the target host I'm trying to deploy it on (US, DE, etc)
• I have actually read the above checkboxes before checking them, including this one, which I have intentionally left unchecked as confirmation of this statement

Agreement

• I believe this is an issue with the actual payload itself. I acknowledge this form is not a request for help following instructions.
• I have carefully read and filled out every section of this issue form to the best of my ability. I acknowledge by providing insufficient information I cannot receieve adequate assistance.

[dallaswinger]

1. you checked this box: "I have actually read the above checkboxes before checking them, including this one, which I have intentionally left unchecked as confirmation of this statement"

2. you didnt provide a valid link.

[bad-antics]

This is a false positive from your antivirus. Here's what's happening:

Why AV flags this repo:

This repository contains penetration testing payloads — scripts designed to test system security. Antivirus software is designed to detect exactly these kinds of tools, so flagging them is expected behavior.

Specifically:

• VBS/Adodb.D is a generic AV signature for VBScript-based download/execute patterns
• Many DuckyScript payloads generate PowerShell or VBScript that downloads and executes code — this is the same pattern malware uses
• AV engines scan repository contents (including .txt files with payload code) and flag them

This is normal and expected:

• The Hak5 USB Rubber Ducky is a legitimate penetration testing tool
• These payloads are open source and documented
• Your AV is correctly identifying the behavior pattern — that's its job
• No one is being "sneaky" — these are intentional security testing tools

How to download:

1. Add an AV exclusion for the download directory (temporarily)
2. Use git clone instead of downloading the ZIP — AV scans ZIP files more aggressively:

   git clone https://github.com/hak5/usbrubberducky-payloads.git

3. Disable real-time scanning temporarily while downloading (re-enable after)

Important:

These payloads are for authorized security testing only on systems you own or have written permission to test. The fact that AV detects them shows they are effective at mimicking real attack patterns — which is the whole point of penetration testing.