r77 Rootkit

Fileless ring 3 rootkit
  • Hides processes, files, network connections, etc.
  • Out of the box, single file installer
  • Fileless persistence, in-memory injection

r77 Rootkit

PEunion

Crypter, binder & downloader
  • In-memory decryption & execution
  • Two-layer execution architecture

PEunion

Living Off The Land

State of the art fileless attacks
  • Execution without any files
  • Process injection
  • Persistence

... It's technically not even there

Living Off The Land