Loading malware…
r77 is an open-source Windows rootkit created by bytecode77 and frequently repurposed by criminal malware operators as a stealth and persistence component. It is designed to hide processes, files, and registry artifacts through user-mode API hooking, and observed variants have been used to remain deeply embedded on compromised systems while concealing follow-on payloads such as stealers, loaders, and remote-access malware. Public reporting has documented r77 being installed by other malware families, including Osno, and being delivered in broader intrusion chains such as trojanized software installers and ClickFix campaigns.
Observed r77-based intrusion chains show the malware being used primarily for defense evasion and persistence after initial compromise rather than as a standalone initial-access tool. In Windows-focused campaigns, r77 components have been staged with AMSI bypass functionality, reflective injection into system processes, and service- or registry-based persistence. The rootkit has been observed hiding artifacts that follow a naming convention associated with its proof-of-concept implementation, enabling operators to conceal malware files, processes, and related system modifications from common administrative and security tools.
Threat actors have incorporated modified or stock r77 builds into multi-component attack frameworks to support post-exploitation objectives. In documented cases, r77 has been paired with malware that performs credential and data theft, lateral movement, antivirus impairment, and destructive activity. It has also appeared in socially engineered delivery chains, including ClickFix lures, and in software supply-chain compromises affecting Windows users. Because r77 is openly available and adaptable, its presence does not by itself uniquely identify a specific threat actor, but it is a recurring stealth component in commodity and opportunistic malware operations targeting Windows environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
The third script also creates a .cmd file in the Windows startup folder, naming it after the user’s hostname, and schedules a system restart. After the device restarts, the .cmd file launches a large DLL through rundll32.exe and attempts to deliver the final payload.
The ClickFix technique attempts to trick users into running malicious commands on their devices... It typically gives the users instructions that involve clicking prompts and copying, pasting, and running commands directly in the Windows Run dialog box, Windows Terminal, or Windows PowerShell.
Osno registers the rootkit DLL to AppInit_DLLs and enables LoadAppInit_DLLs so it is loaded with every process... The rootkit uses MinHook to redirect WinAPI calls, so that it hides processes and file names
It’s often combined with delivery vectors such as phishing, malvertising, and drive-by compromises, most of which even impersonate legitimate brands and organizations... recent ones spoof Google’s reCAPTCHA and Cloudflare’s Turnstile solution. We’ve even observed threat actors spoof social media platforms like Discord.
However, whether the malware is on disk or in memory, we’ve observed its code injected into LOLBins, such as msbuild.exe, regasm.exe, or powershell.exe.
These final payloads are often 'fileless'... they’re loaded and launched in memory by living-off-the-land binaries (LOLBins)... we’ve observed its code injected into LOLBins, such as msbuild.exe, regasm.exe, or powershell.exe.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
Other indicator types observed in public reporting.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Open-source Windows rootkit used here via a stager to bypass AMSI, inject hooking DLLs into winlogon.exe, hide processes/files/registry keys with the $77 prefix, and maintain persistence through registry storage and a Windows service.
Rootkit component referenced as part of the analyzed malware's stealth and persistence toolkit.
Open-source rootkit used to cloak files/registry keys/tasks and provide stealth/persistence; deployed in the OBSCURE#BAT campaign.
r77 is a rootkit family used in ClickFix and FileFix campaigns to hide malware processes and maintain persistence on infected systems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.