R77 rootkit
r77 rootkit is a Windows rootkit observed as a final-stage payload in multiple criminal intrusion chains. The provided content links it to ClickFix-style social-engineering campaigns in which victims are tricked by fake CAPTCHA or verification pages into executing obfuscated commands, often via the Microsoft-signed SyncAppvPublishingServer.vbs App-V script and in-memory PowerShell stages. In these campaigns, the final shellcode loader can deploy malware including Amatera Stealer, Lumma Stealer, Xworm, AsyncRAT, and the r77 rootkit. One cited campaign delivered the r77 rootkit via Discord-themed ClickFix lures under the name OBSCURE#BAT. The content also notes r77 rootkit bundled with the XMRig cryptominer, including a sample protected by the PackXOR private packer together with SilentCryptoMiner (SHA-256: b86612a6d62a1789031248bdb732b8bff51acaeaa687c3559f0980560a8abf2f). Another mention references an 'r77 Rootkit Bot' in a JDownloader supply-chain attack that killed antivirus products, but no further high-confidence technical details are provided in the supplied material. Based on the content, r77 rootkit is associated with financially motivated malware delivery activity, Windows-focused execution chains, and use alongside stealers, RATs, and cryptomining payloads.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Persistence
2 techniques
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
3 techniques
Stealth
The rootkit stager is a 176 KB native x86 PE based on the open-source r77 rootkit... These DLLs hook Windows API functions to hide any process, file, or registry key whose name starts with the $77 prefix.
IOCs tracked for this family
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Rootkit payload delivered in ClickFix campaigns (including Discord-themed lures) to provide stealth/persistence on compromised hosts.
Rootkit component observed bundled with XMRig in samples protected by PackXOR (and additionally obfuscated with SilentCryptoMiner in described cases).
Referenced as a rootkit bot involved in a JDownloader supply-chain attack and described as disabling antivirus software.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.