search

bytecode77 / r77-rootkit

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.
https://bytecode77.com/r77-rootkit
BSD 2-Clause "Simplified" License
1.61k stars 392 forks source link

How to start executable files hidden by r77rookit? #56

Closed Summ3rM0 closed 10 months ago

Summ3rM0 commented 10 months ago

I guess it's a simple problem, but I'm a noob and don't know how to solve it. Now the situation is that I need to open an executable file hidden by r77 at boot time. I know that I can get r77 to start it by writing the path to this executable file to the registry, but the problem is that this open executable file (temporarily named $77_A.exe) needs to open another executable file ($77_B.exe). However,$77_B.exe is also hidden, so obviously $77_A.exe cannot open $77_B.exe, how to solve this situation? This paragraph was generated by machine translation, and I'm sorry if it's difficult to understand.

bytecode77 commented 10 months ago

$77_A.exe is not injected with the rootkit, because r77 never injects files with the $77 prefix. So, it should be able to see $77_B.exe.

Why does the second executable not start? You can debug your startup process by just writing a logfile to disk and see how far it goes, until it doesn't go further. Have you tried to name the second executable just B.exe and see whether that works?

Since I can't see what exactly you are doing, you need to try out a few scenarios and let me know, where exactly startup fails.

Summ3rM0 commented 10 months ago

Thank you very much for your reply! In other words, I want to start it with $77_B.exe while hiding $77_B.exe. This process is implemented after the startup, so I can't solve this problem by adding $77_B.exe to startup. My English is terrible, I mean, is there a way to hide file \ registry values and open \ read them at the same time? But they need to be hidden the whole time

bytecode77 commented 10 months ago

If your first process is $77A.exe, then it's not injected by r77 and therefore it can see $77B.exe. There shouldn't be any problem. But obviously it doesn't start, so, try to narrow down the issue. See, whether the second executable starts and crashes, or does not start at all. Log any errors when starting the second executable, etc...

Summ3rM0 commented 10 months ago

How to keep the first exe from being injected?

Summ3rM0 commented 10 months ago

Now I don't seem to understand the automatic startup, I write to the registry and then run install.exe, but when I restart $77A.exe does not automatically start

Summ3rM0 commented 10 months ago

如何防止第一个exe被注入？

i have solved this

Summ3rM0 commented 10 months ago

thx very much, i have solve all the difficulities i faces