Fix invalid YAML

This commit is contained in:
Wietze 2021-01-10 14:46:36 +00:00
parent d15172284a
commit de50a47957
No known key found for this signature in database
GPG Key ID: E17630129FF993CF
2 changed files with 8 additions and 10 deletions

View File

@ -21,7 +21,7 @@ Detection:
Resources:
- Link: https://bartblaze.blogspot.com/2019/03/run-applications-and-scripts-using.html
- Link: https://twitter.com/bartblaze/status/1107390776147881984
Acknowledgement:
Acknowledgement:
- Person: Bart
Handle: @bartblaze
Handle: '@bartblaze'
---

View File

@ -1,20 +1,18 @@
Name: aswrundll.exe
Description: This process is used by AVAST antivirus to run and execute any modules
Author: Eli Salem
Created: 19\03\2019
Created: 2019-03-19
Commands:
- Command: "C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll"
- Command: "\"C:\\Program Files\\Avast Software\\Avast\\aswrundll\" \"C:\\Users\\Public\\Libraries\\tempsys\\module.dll\""
Description: Load and execute modules using aswrundll
Usecase: Execute malicious modules using aswrundll.exe
Category: Execute
Privileges: Any
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Full_Path:
- Path: C:\Program Files\Avast Software\Avast\aswrundll
Code_Sample:
- Code: ["C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll" "C:\Users\module.dll"]
- Path: C:\Program Files\Avast Software\Avast\aswrundll
Resources:
- Link: https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research
Acknowledgement:
- Link: https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research
Acknowledgement:
- Person: Eli Salem
handle: https://www.linkedin.com/in/eli-salem-954728150
Handle: https://www.linkedin.com/in/eli-salem-954728150