Hardcoded in plaintext at offset 0x1A3F of the DLL. RSWATCH.EXE registers as a Windows service named “Rahim Soft Watch Service” with a description: “Monitors database integrity.”

rs_backup_user / rs_admin_1999

RS: Executing raw: [string] But crucially, the function does not sanitize input—it passes the buffer directly to an internal _system() call. This makes , provided the attacker controls the query string.

The file is not a true VXD but a disguised NT native API injector. Static analysis reveals a PE stub that, when loaded, calls ZwSetSystemInformation to hook interrupt 2Eh—essentially a rootkit-like persistence mechanism predating commercial rootkits by 3–4 years.