r77Malware
- r77 rootkit
According to the author, r77 is a ring 3 rootkit that hides everything: * Files, directories * Processes & CPU usage * Registry keys & values * Services * TCP & UDP connections * Junctions, named pipes, scheduled tasksFrom MISP Galaxy
Last reported 3 years ago, by Elastic Security Labs1 report
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1014Rootkit
“Elastic Security Labs steps through the r77 rootkit”
- T1053.005Scheduled Task
“…dule builds a PowerShell command that loads the stager module from the registry and executes it, the installer module then creates a scheduled task to run the PowerShell command.”
- T1055.012Process Hollowing
“This is accomplished using a process hollowing technique into a newly spawned process under another legitimate process through PPID spoofing.”
- T1134.004Parent PID Spoofing
“Parent PID spoofing”
What the reports say
1 report, newest first · the exact sentence from each-
Elastic Security Labs steps through the r77 rootkit“Elastic Security Labs steps through the r77 rootkit”
Indicators in its reports
named in the reports above- msupdate[.]infoin 1 report
- cfc76dddc74996bf…656d4d316c0cin 1 report
- 21e7f69986987fc7…5061b2d86d4fin 1 report
- 3dc94c88caa3169e…72b4ba999ea6in 1 report
- 91c6e2621121a687…b9edd8e31796in 1 report
- 916c805b0d512dd7…7cb1f0ac7f60in 1 report
- 96849108e13172d1…529eacc02d89in 1 report
- hxxps://github[.]com/microsoft/Detoursin 1 report
- hxxps://github[.]com/xmrig/xmrigin 1 report
- hxxps://ru.wikipedia[.]org/wiki/Remote_Manipulator_Systemin 1 report
- 5.133.65[.]53in 1 report
- 5.133.65[.]54in 1 report
- 5.133.65[.]55in 1 report
- 5.133.65[.]56in 1 report
- 9fb38412cac94255…a9ff060b5c0cin 1 report
- aeb6a7b9ca890dc0…a398bf69392fin 1 report
- 29bc88a316e3f34e…977dd990ea77in 1 report
- 10165e27e0db0a67…4a966f0f401ein 1 report
- 757fa687a9b4d461…9625429cc551in 1 report
- a7e31abe10be6bca…b15469fc1d3ain 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.