Archiving off legacy LOLUtilz

Archive-Old-Version/LOLUtilz/OtherBinaries/aswrundll.yml

@@ -0,0 +1,20 @@
+Name: aswrundll.exe
+Description: This process is used by AVAST antivirus to run and execute any modules
+Author: Eli Salem
+Created: '2019-03-19'
+Commands:
+  - Command: '"C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll"'
+    Description: Load and execute modules using aswrundll
+    Usecase: Execute malicious modules using aswrundll.exe
+    Category: Execute
+    Privileges: Any
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
+Full_Path:
+- Path: 'C:\Program Files\Avast Software\Avast\aswrundll'
+Code_Sample: 
+- Code: '["C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll" "C:\Users\module.dll"]'
+Resources:
+ - Link: https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research
+Acknowledgement:
+  - Person: Eli Salem 
+    handle: 'https://www.linkedin.com/in/eli-salem-954728150'