rabbids.cc: a Windows infostealer download site that uses DLL sideloading, and what to do if you ran a file from it

What rabbids.cc is, and what we know about it

rabbids.cc is a web address, not a program on your PC. The abuse.ch project URLhaus lists it as a place that served malware. We found no public write-up of this domain, so this page rests on the URLhaus rows in our database, one visit of our own, the registration record and what Microsoft and MITRE document about the technique in the tags.

1. 1

   What URLhaus lists

   Five file addresses on this host, every one with the threat type malware_download, all added on 28 September 2026 between 06:11:19 and 06:11:20 UTC by one reporter account named hatrask. The files are /encrypted/1.zip, /encrypted/7za.exe, /start.php, /screen.php and /end.php.

2. 2

   What the tags say

   All five rows carry the same twelve tags, including infostealer, stealer, dll-sideloading, exfiltration, surveillance, c2, dropper and zip. Two more tags, Lzveil and Yogi, look like names the reporter gave to a family or a kit. We found no source that explains either word.

3. 3

   What is still online

   When we read the feed on 10 October 2026, the zip and the 7za.exe file were marked online. The three php files were marked offline. Online means the reporting system still got an answer for that address at its last check, not that the file is safe to open.

4. 4

   What we could not confirm

   We downloaded nothing, so we do not know what the archive holds, what the stealer collects or where it sends data. The tags are the reporter's labels, not our finding.

5. 5

   What it means for you

   If the name only showed up in a block list or a security scan, nothing is installed because of it. If you downloaded and ran a file from it, treat the PC as compromised and follow the plan on this page.

Kind of threat

A malware download host: a zip, an exe and three php files, all tagged infostealer

Malware family

Not confirmed. The reporter's tags are Lzveil and Yogi; we found no public analysis of either

Registration

Registered 18 September 2026 through NICENIC International Group, expires 18 September 2027, record last changed 6 October 2026. The owner is not shown

URLhaus entries

5 file addresses, all added on 28 September 2026; 2 online and 3 offline when we read them

Platform

Windows, judging by the exe file and the dll-sideloading tag. No source confirms it

What our check on 10 October 2026 showed, and what it cannot show

We opened https://rabbids.cc/ once, from Lithuania, in an automated Chromium browser set to English. The server answered with HTTP status 200 and an empty page. That is not a clean result. A malware host usually serves files to people who know the exact path, not a front page.

From registration to our test: the dates we have

The history is short. We have a registration date, one burst of reports lasting two seconds, a record change eight days later and our own visit. We know nothing about what the name was used for in between.

1. 18 September 2026

   The domain is registered

   The registration record gives this creation date, with NICENIC International Group as registrar and a one year term ending 18 September 2027. We do not know who registered it.

2. 28 September 2026, 06:11 UTC

   Five files are reported within two seconds

   URLhaus receives /end.php, /screen.php, /encrypted/1.zip, /start.php and /encrypted/7za.exe between 06:11:19 and 06:11:20 UTC. Every row carries the same tags, and one reporter filed them all.

   

3. 6 October 2026

   The registration record changes

   The record shows a last change on this date. It does not say what changed. It may be a routine update, and we found no source that tells which.

4. 10 October 2026

   Our visit finds an empty page

   Our browser reaches https://rabbids.cc/ and gets HTTP 200 with a blank page. URLhaus still lists /encrypted/1.zip and /encrypted/7za.exe as online.

We could not read the URLhaus pages themselves because they ask for a browser check. The entries above come from the same feed as held in our own database.

The five files: what each name suggests, and what we do not know

File names are weak evidence. We list what each one could be and mark which statements are only a reading of the name and tags.

Three php names that read as start, screen and end would fit a program that reports its progress to a server. That is a pattern, not a fact, and we saw none of the traffic.

How DLL sideloading works, and why a tag like this matters

The tag dll-sideloading names a method, not a product. MITRE and Microsoft describe the method in general terms, and we use those pages to explain it. We did not run the files, so we cannot say which program or which DLL these ones use.

1. 1

   How Windows looks for a DLL

   Microsoft says that when a program loads a DLL without a full path, Windows searches a fixed list of folders. With safe search mode on, the first folder is the one the application was loaded from, then the system folders, the current directory and the PATH folders.

2. 2

   How an attacker uses that order

   MITRE describes sideloading as placing a malicious DLL next to a legitimate, often signed program that loads it. The program starts as normal, finds the planted file first and runs its code.

3. 3

   Why it hides well

   According to MITRE, the payload then runs under a trusted process, and the planted DLL may also load the real one so the program appears to work. A tool that looks at program names alone may see only a familiar name.

4. 4

   Why 7za is in the picture

   A public detection rule in the Sigma collection flags a file named 7za.dll that a process loads from outside the Program Files folders. The rule is rated low severity because legitimate programs in AppData can use that DLL. We found no source that links it to this host.

5. 5

   What you can check

   A copy of a tool that sits in your Downloads or Temp folder, beside a DLL you did not install, is a reason to stop. A real installed 7-Zip lives in Program Files and does not need a zip from an unknown site.

What an infostealer takes, and what the tags promise

The tags say infostealer, exfiltration and surveillance. We have no analysis of these files, so the list below is what stealers in general go after, not a list of what these files took.

The tag surveillance and the name screen.php may mean the program also takes screenshots. We cannot confirm it. What matters is the habit it implies: assume anything you typed or saved on that PC was seen.

Stolen cookies are the quiet part. A thief who holds a valid session cookie can be signed in to an account without the password, so a password change alone may not end it.

What this can cost you

Seeing this name in a log costs nothing. The risks below apply to a PC that really ran a file from this address.

• High

  Stolen passwords and sessions

  A stealer's main job is to copy saved logins and cookies. Email, bank, work and social accounts are the first to go.

• High

  Crypto taken for good

  A moved balance cannot be taken back. Wallet files and recovery phrases on the PC are a prime target for programs of this kind.

• Medium

  A second program on the PC

  A dropper may fetch more malware after the first step. The tag dropper on these rows makes that a real possibility, though we did not see it.

• Medium

  Fraud on your accounts

  With your email and a session, a thief can reset other accounts, ask your contacts for money or place orders.

• Low

  Nothing, if you only saw the name

  A name in a firewall log or a blocked link is not an infection.

What you might see, and why you may see nothing

Stealers try not to be noticed. The signs below follow from how such programs work, and none of them proves infection alone.

How people meet a download host like this

No source tells us how anyone reached rabbids.cc. The routes below are common for stealers in general, and we mark them as such.

1. 1

   A free program that is not free

   Cracks, keygens and pirated installers are a common cover for stealers. A zip with a password and a readme is typical.

2. 2

   A fake download page

   A page that looks like a tool's own site offers an archive. The real tool's address is a short check away.

3. 3

   A link in a chat or a mail

   A message with a link to a zip and a request to open it. We do not know of such a message for this host.

4. 4

   A line in a log

   If you only found rabbids.cc in a firewall or DNS log, find out which program asked for it. That program is the suspect.

Check your PC first, before you delete anything

The question that matters is whether a file from this address ran on your PC. The checks below change nothing.

1. 1

   Look at your downloads

   Open File Explorer > Downloads and sort by date. Look for a zip, a 7za.exe or a program that you did not mean to get around the time you visited an unfamiliar site.

2. 2

   Read the browser history

   In Chrome and Edge press Ctrl+H and search for rabbids. In Firefox press Ctrl+H, then search the sidebar. A hit tells you the day and the page you were on.

3. 3

   Check Windows Security history

   Open Windows Security > Virus & threat protection > Protection history and read the recent items. Blocked or quarantined items from that day are a clue.

4. 4

   Look at running programs

   Press Ctrl+Shift+Esc to open Task Manager. On the Details tab look for a 7za.exe or a program with a strange name that runs from AppData or Temp.

5. 5

   Know what a clean check means

   These checks cannot look inside a hidden program. A stealer may have run once and left, so a quiet PC does not prove it was never touched.

Scan from outside Windows: Microsoft Defender Offline

An offline scan runs before the normal Windows starts, so a hidden program cannot hide from it as easily. Microsoft says it is meant for malware that tries to bypass the Windows shell.

1. 1

   Do the account steps first

   Before you scan, use another device to change your passwords, as described in the next section. A stealer may already hold the old ones, and the scan does not undo that.

2. 2

   Get the PC ready

   Save open files and quit your programs, because the PC restarts by itself. The scan needs an administrator account and a working Windows Recovery Environment. In an administrator Command Prompt type reagentc /info. If it says Disabled, type reagentc /enable. Microsoft warns that with recovery off the scan does not start and no error appears.

3. 3

   Pause BitLocker

   A PC with BitLocker on the system drive may ask for the recovery key at the restart. Suspend BitLocker first, using Microsoft's linked instructions.

4. 4

   Launch it from Windows Security

   Go to Windows Security > Virus & threat protection > Scan options, select Microsoft Defender Offline scan and press Scan now. Accept the prompts. Windows signs you out and boots into the scan, which Microsoft says takes about 15 minutes. As an administrator you can also type Start-MpWDOScan in PowerShell.

5. 5

   Read the result

   When Windows returns, open Windows Security > Virus & threat protection > Protection history. On Windows 10 the same screen is under Settings > Update & Security > Windows Security. Microsoft lists Windows on ARM as unsupported, and Defender Antivirus must be your main antivirus.

6. 6

   Treat a clean report with care

   No detection is not proof of a clean PC, because we do not know what these files install. If you ran one of them, copy your documents off and reinstall Windows.

If you use a Mac, an iPhone or an Android phone

The exe file and the dll-sideloading tag point at Windows. We found nothing that says these files run on anything else.