mirror of
				https://github.com/LOLBAS-Project/LOLBAS
				synced 2025-11-04 02:29:34 +01:00 
			
		
		
		
	Add aswrundll.exe non microsoft lolbin
This commit is contained in:
		
							
								
								
									
										20
									
								
								yml/LOLUtilz/OtherBinaries/aswrundll.yml
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										20
									
								
								yml/LOLUtilz/OtherBinaries/aswrundll.yml
									
									
									
									
									
										Normal file
									
								
							@@ -0,0 +1,20 @@
 | 
			
		||||
Name: aswrundll.exe
 | 
			
		||||
Description: This process is used by AVAST antivirus to run and execute any modules
 | 
			
		||||
Author: Eli Salem
 | 
			
		||||
Created: 19\03\2019
 | 
			
		||||
Commands:
 | 
			
		||||
  - Command: "C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll" 
 | 
			
		||||
    Description: Load and execute modules using aswrundll
 | 
			
		||||
    Usecase: Execute malicious modules using aswrundll.exe
 | 
			
		||||
    Category: Execute
 | 
			
		||||
    Privileges: Any
 | 
			
		||||
    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 | 
			
		||||
Full_Path:
 | 
			
		||||
- Path: C:\Program Files\Avast Software\Avast\aswrundll
 | 
			
		||||
Code_Sample: 
 | 
			
		||||
- Code: ["C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll" "C:\Users\module.dll"]
 | 
			
		||||
Resources:
 | 
			
		||||
 - Link: https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research
 | 
			
		||||
 Acknowledgement:
 | 
			
		||||
  - Person: Eli Salem 
 | 
			
		||||
    handle: https://www.linkedin.com/in/eli-salem-954728150
 | 
			
		||||
		Reference in New Issue
	
	Block a user