The Windows Archives project continues to catalog such “abandonware with teeth.” Part 3 will examine Rahim Soft’s kernel hooking mechanisms on Windows XP SP2, and their eerie similarity to modern EDR bypass techniques. End of Part 2 deep write-up. Archive checksum (reference): SHA-256 of RAHIMDB.DLL v2.1: 7A4F2B8C9D0E1F2A3B4C5D6E7F8A9B0C1D2E3F4A5B6C7D8E9F0A1B2C3D4E5F6
Hardcoded in plaintext at offset 0x1A3F of the DLL. RSWATCH.EXE registers as a Windows service named “Rahim Soft Watch Service” with a description: “Monitors database integrity.” Windows Archives - Rahim soft - Part 2
RS: Executing raw: [string] But crucially, the function does not sanitize input—it passes the buffer directly to an internal _system() call. This makes , provided the attacker controls the query string. The Windows Archives project continues to catalog such
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\VirtualDeviceDrivers RSWATCH
In archival samples, we found a hardcoded backdoor credential:
This explains why modern AV flags it generically: not because it’s malicious per se, but because its behavior overlaps with known stealth patterns . RAHIMDB.DLL exports a function RS_ExecuteRaw that accepts a string parameter. Under normal conditions, it processes indexed sequential access method (ISAM) queries. However, passing a string longer than 260 bytes triggers an unusual debug print :
rs_backup_user / rs_admin_1999