AV prevents execution

[passwordleak]

o.CreateInstance(entry_class);

It's prevented from executing because of the string "EmpireHost." I tried with a different string and it seems to work.

I suggest instead of releasing the output as the code, release the entire setup, so we can generate our own payloads with randomized entry class names. Or maybe there is an even better way of dynamically generating the entry class? Perhaps this is outside of the scope for the project...

Using Symantec Endpoint Protection.

[sharpbazil]

What was used to generate the embedded empire host? What was fed into DotNetToJscript?

[thehillionaire]

Hey @passwordleak what command did you use to deserialize the script?