Sitting on the Lolbins, 8

August 27, 2019 in Anti-Forensics, Living off the land, LOLBins, Reusigned Binaries

Another launcher from Dell is presented below. Similarly to the one I described earlier, it relies on an .ini file named after the main .exe. This time the commands can be selected depending on an OS version though e.g.:

[CommandLine]
Command_x86=java.exe
Command_XP_x64=java.exe
Command_2003_x64=java.exe
Command_VISTA_x64=java.exe

Sample: 00F87A7F5BC496DA831ECA31010521D2297621575DAA163FA2E9CD50DB5461A9

Share this :)

Comments are closed.