LOLBAS/yml/LOLUtilz/OtherBinaries/aswrundll.yml

21 lines
927 B
YAML
Raw Normal View History

2019-03-20 09:53:11 +01:00
Name: aswrundll.exe
Description: This process is used by AVAST antivirus to run and execute any modules
Author: Eli Salem
Created: 19\03\2019
Commands:
- Command: "C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll"
Description: Load and execute modules using aswrundll
Usecase: Execute malicious modules using aswrundll.exe
Category: Execute
Privileges: Any
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Full_Path:
- Path: C:\Program Files\Avast Software\Avast\aswrundll
Code_Sample:
- Code: ["C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll" "C:\Users\module.dll"]
Resources:
- Link: https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research
Acknowledgement:
- Person: Eli Salem
handle: https://www.linkedin.com/in/eli-salem-954728150