search

bytecode77 / r77-rootkit

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.
https://bytecode77.com/r77-rootkit
BSD 2-Clause "Simplified" License
1.59k stars 389 forks source link

registry problem... #33

Closed rednas0812 closed 2 years ago

rednas0812 commented 2 years ago

Hiding a process by process name "under key, process_names" doesn't seem to work for me? how do i hide a process name using the name of the process instead of the pid?

bytecode77 commented 2 years ago

Did you set it up like this?

Note, that the contents of the value is relevant, but not the name:

image

Also, is r77 injected in TaskMgr? Even though r77 is completely fileless, AV vendors do update their detection routines, which can cause r77 to stop working correctly. Can you check the Test Console, whether r77 is properly running? It doesn't need to be installed... If it's injected in TaskMgr.exe, that's enough.

rednas0812 commented 2 years ago

Hi! It actually worked but somehow the testconsole didn't mark it as hidden but in the taskmanager it was hidden...

thank you very much!

bytecode77 commented 2 years ago

Glad it works.

The test console actually only shows the hidden-icon when hidden by PID, not when hidden by process name. When you click on that button, the PID is entered in the $77config key, not the process name.