2019-03-20 09:53:11 +01:00
|
|
|
Name: aswrundll.exe
|
|
|
|
|
Description: This process is used by AVAST antivirus to run and execute any modules
|
|
|
|
|
Author: Eli Salem
|
2021-10-22 15:20:35 +02:00
|
|
|
Created: '2019-03-19'
|
2019-03-20 09:53:11 +01:00
|
|
|
Commands:
|
2021-03-09 15:04:09 +01:00
|
|
|
- Command: '"C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll"'
|
2019-03-20 09:53:11 +01:00
|
|
|
Description: Load and execute modules using aswrundll
|
|
|
|
|
Usecase: Execute malicious modules using aswrundll.exe
|
|
|
|
|
Category: Execute
|
|
|
|
|
Privileges: Any
|
|
|
|
|
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
|
|
|
|
|
Full_Path:
|
2021-03-09 15:04:09 +01:00
|
|
|
- Path: 'C:\Program Files\Avast Software\Avast\aswrundll'
|
2019-03-20 09:53:11 +01:00
|
|
|
Code_Sample:
|
2021-03-09 15:04:09 +01:00
|
|
|
- Code: '["C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll" "C:\Users\module.dll"]'
|
2019-03-20 09:53:11 +01:00
|
|
|
Resources:
|
|
|
|
|
- Link: https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research
|
2021-03-09 15:04:09 +01:00
|
|
|
Acknowledgement:
|
2019-03-20 09:53:11 +01:00
|
|
|
- Person: Eli Salem
|
2021-10-22 15:20:35 +02:00
|
|
|
handle: 'https://www.linkedin.com/in/eli-salem-954728150'
|
