Windows Archives - Rahim Soft - Part 2 Now

Hardcoded in plaintext at offset 0x1A3F of the DLL. RSWATCH.EXE registers as a Windows service named “Rahim Soft Watch Service” with a description: “Monitors database integrity.”

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\VirtualDeviceDrivers Windows Archives - Rahim soft - Part 2

In archival samples, we found a hardcoded backdoor credential: Hardcoded in plaintext at offset 0x1A3F of the DLL