Loading malware…
r77 rootkit is a Windows user-mode rootkit used to conceal malicious activity by hiding processes, files, and registry artifacts from userland tools. It has been observed both as a standalone payload and as a component bundled with other malware, including cryptomining operations, bot malware, and commodity remote-access ecosystems. Reported deployments include use by the Necro bot on Windows, where a modified r77 variant is injected to hide malware-related artifacts, and inclusion in leaked or modified XWorm builders, where a rootkit component installs a customized r77-derived implant to hide operator-selected objects.
The malware’s core behavior centers on defense evasion. Observed variants hook multiple Windows native API functions in ntdll to interfere with process, directory, and registry enumeration, enabling the rootkit to suppress visibility of selected objects. In documented campaigns, operators configured naming conventions or prefixes that the rootkit uses to decide what to hide. Installation has been seen via shellcode-based loaders and reflective DLL loading, and it has also appeared as a final-stage payload delivered by multi-stage social-engineering chains such as ClickFix. These delivery chains have also been used to deploy stealers and remote-access trojans, indicating r77 is often one element in broader post-compromise tooling rather than the sole objective.
r77 rootkit primarily targets Windows systems. Its role is typically to protect other malware from discovery and removal, including cryptominers such as XMRig, bot components, and other payloads executed after initial access. Public reporting also notes packed and obfuscated distributions in which r77 is bundled with additional malware or protected by custom packers. High-confidence reporting supports its use as a user-mode stealth mechanism for persistence-adjacent concealment and post-exploitation defense evasion, rather than as an initial-access tool by itself.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Necro first downloads the corresponding version of the rootkit file, which is dynamically loaded and run directly in memory by process injection... Necro uses process injection to load the rootkit by wrapping the dll file into a shellcode and then injecting the whole shellcode into the process memory.
The open-source project r77 rootkit is used directly on Windows systems. It is a ring3 layer rootkit that intercepts and filters information about the target process by globally hooking some functions of ntdll.dll.
Inside, it wraps the legitimate JDownloader installer alongside an XOR-encrypted second-stage PE... Stage 2's strings are all XOR-obfuscated with the same fywo key used for its resources.
Necro first downloads the corresponding version of the rootkit file, which is dynamically loaded and run directly in memory by process injection... Necro uses process injection to load the rootkit by wrapping the dll file into a shellcode and then injecting the whole shellcode into the process memory.
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Rootkit payload delivered in ClickFix campaigns (including Discord-themed lures) to provide stealth/persistence on compromised hosts.
Rootkit installed by a leaked/modified XWorm plugin to hide processes prefixed with "$CRX".
Rootkit component observed bundled with XMRig in samples protected by PackXOR (and additionally obfuscated with SilentCryptoMiner in described cases).
Referenced as a rootkit bot involved in a JDownloader supply-chain attack and described as disabling antivirus software.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.