Koadic

What it does

Koadic is a Windows post-exploitation rootkit/C2 that operates via Windows Script Host, similar in feel to Empire. It's handy for living-off-the-land Windows operations.

Common use cases

• •C2 operations through Windows Script Host to evade application-whitelisting controls.
• •Post-exploitation of Windows hosts where PowerShell logging is heavily monitored.
• •Deploy JScript and VBScript stagers that blend into normal Windows administrative traffic.

Key features

• •Operates entirely through Windows Script Host — no .NET or PowerShell required.
• •Stagers delivered as JScript or VBScript files to blend with legitimate scripts.
• •Module system for keylogging, screen capture, privilege escalation, and lateral movement.
• •Listener support for HTTP and HTTPS with optional SSL certificate configuration.

Source