#rrcfg

November 4, 2026

A sideloading chain hides its first stage inside the certificate table of a genuine Microsoft-signed sllauncher.exe (the Silverlight launcher), so Authenticode still validates while a fake oledlg.dll pulls the encrypted blob out of the signed EXE behind a CA FE BA BE marker. It ends in a lean modular x64 implant Nextron tracks as RRCfg — host profiling, installed-AV enumeration via WMI, ECDH P-256/AES-GCM over an IOCP TCP client, config under HKCU\SOFTWARE\RRCfg, and no built-in shell or file transfer, with everything else delivered as PE plugins. Lures are generic invoice and payment documents aimed at Western businesses (Nextron IOC report). · Tradecraft & Detection