public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-12-27 07:18:05 +01:00
Code Issues Projects Releases Wiki Activity

putting quotes around strings with special chars

Browse Source
This commit is contained in:
Filipe Spencer Lopes 2021-03-09 15:04:09 +01:00
parent ff9f5cff3d
commit 29acd82968
2 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
yml/LOLUtilz/OtherBinaries/RunCmd_X64.yml
View File

@ -23,5 +23,5 @@ Resources:
- Link: https://twitter.com/bartblaze/status/1107390776147881984 - Link: https://twitter.com/bartblaze/status/1107390776147881984
Acknowledgement: Acknowledgement:
- Person: Bart - Person: Bart
Handle: @bartblaze Handle: '@bartblaze'
--- ---

6
yml/LOLUtilz/OtherBinaries/aswrundll.yml
View File

@ -3,16 +3,16 @@ Description: This process is used by AVAST antivirus to run and execute any modu
Author: Eli Salem Author: Eli Salem
Created: 19\03\2019 Created: 19\03\2019
Commands: Commands:
- Command: "C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll" - Command: '"C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll"'
Description: Load and execute modules using aswrundll Description: Load and execute modules using aswrundll
Usecase: Execute malicious modules using aswrundll.exe Usecase: Execute malicious modules using aswrundll.exe
Category: Execute Category: Execute
Privileges: Any Privileges: Any
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Full_Path: Full_Path:
- Path: C:\Program Files\Avast Software\Avast\aswrundll - Path: 'C:\Program Files\Avast Software\Avast\aswrundll'
Code_Sample: Code_Sample:
- Code: ["C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll" "C:\Users\module.dll"] - Code: '["C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll" "C:\Users\module.dll"]'
Resources: Resources:
- Link: https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research - Link: https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research
Acknowledgement: Acknowledgement: