public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-12-26 14:59:03 +01:00
Code Issues Projects Releases Wiki Activity

Fix invalid YAML

Browse Source
This commit is contained in:
Wietze 2021-01-10 14:46:36 +00:00
parent d15172284a
commit de50a47957
No known key found for this signature in database
GPG Key ID: E17630129FF993CF
2 changed files with 8 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
yml/LOLUtilz/OtherBinaries/RunCmd_X64.yml
View File

@ -21,7 +21,7 @@ Detection:
Resources: Resources:
- Link: https://bartblaze.blogspot.com/2019/03/run-applications-and-scripts-using.html - Link: https://bartblaze.blogspot.com/2019/03/run-applications-and-scripts-using.html
- Link: https://twitter.com/bartblaze/status/1107390776147881984 - Link: https://twitter.com/bartblaze/status/1107390776147881984
Acknowledgement: Acknowledgement:
- Person: Bart - Person: Bart
Handle: @bartblaze Handle: '@bartblaze'
--- ---

14
yml/LOLUtilz/OtherBinaries/aswrundll.yml
View File

@ -1,20 +1,18 @@
Name: aswrundll.exe Name: aswrundll.exe
Description: This process is used by AVAST antivirus to run and execute any modules Description: This process is used by AVAST antivirus to run and execute any modules
Author: Eli Salem Author: Eli Salem
Created: 19\03\2019 Created: 2019-03-19
Commands: Commands:
- Command: "C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll" - Command: "\"C:\\Program Files\\Avast Software\\Avast\\aswrundll\" \"C:\\Users\\Public\\Libraries\\tempsys\\module.dll\""
Description: Load and execute modules using aswrundll Description: Load and execute modules using aswrundll
Usecase: Execute malicious modules using aswrundll.exe Usecase: Execute malicious modules using aswrundll.exe
Category: Execute Category: Execute
Privileges: Any Privileges: Any
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Full_Path: Full_Path:
- Path: C:\Program Files\Avast Software\Avast\aswrundll - Path: C:\Program Files\Avast Software\Avast\aswrundll
Code_Sample:
- Code: ["C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll" "C:\Users\module.dll"]
Resources: Resources:
- Link: https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research - Link: https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research
Acknowledgement: Acknowledgement:
- Person: Eli Salem - Person: Eli Salem
handle: https://www.linkedin.com/in/eli-salem-954728150 Handle: https://www.linkedin.com/in/eli-salem-954728150