Full Report
Fake Xeno Executor installers are infecting unsuspecting Roblox players with malware that provides remote access and steals sensitive information. [...]
Analysis Summary
# Tool/Technique: Fake Xeno Executor (Powercat Variant)
## Overview
This campaign utilizes a Trojanized version of the "Xeno Executor" (a Roblox script injection tool). Attackers lure gamers seeking cheats or automation scripts with "undetected" versions of the software. Instead of the legitimate utility, the package installs a sophisticated Java-based Remote Access Trojan (RAT) and Infostealer designed to exfiltrate credentials, financial data, and provide full remote desktop control.
## Technical Details
- **Type:** Malware (RAT / Infostealer)
- **Platform:** Windows (Requires/Bundles Java Runtime Environment)
- **Capabilities:** Credential theft, cryptocurrency theft, surveillance (keylogging/webcam), remote shell access, and file manipulation.
- **First Seen:** Early 2024 (Activity surged in March 2024)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1204.002 - User Execution: Malicious File (Fake installer)
- **TA0002 - Execution**
- T1059.001 - Command and Scripting Interpreter: PowerShell
- T1203 - Exploitation for Client Execution
- **TA0003 - Persistence**
- T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- **TA0007 - Discovery**
- T1082 - System Information Discovery
- T1083 - File and Directory Discovery
- **TA0009 - Collection**
- T1056.001 - Input Capture: Keylogging
- T1113 - Screen Capture
- T1125 - Video Capture (Webcam)
- **TA0010 - Exfiltration**
- T1041 - Exfiltration Over C2 Channel
## Functionality
### Core Capabilities
- **Browser Data Theft:** Extracts cookies, saved passwords, and autofill data from Chromium-based browsers (Chrome, Edge, Brave, Opera, Vivaldi).
- **Token Stealing:** Specifically targets Discord and Roblox session tokens to bypass Multi-Factor Authentication (MFA).
- **Gaming Account Hijacking:** Steals Minecraft and Microsoft Store tokens.
- **Cryptocurrency Theft:** Dedicated modules for Exodus Wallet and scanning for other local wallet directories.
- **Remote Shell:** Provides attackers with an interactive PowerShell or Command Prompt.
### Advanced Features
- **Surveillance Suite:** Real-time desktop streaming, mouse activity tracking, and webcam hijacking.
- **Environment Awareness:** Performs checks to ensure it is not running in a sandbox or analysis environment.
- **Self-Sufficiency:** Bundles its own Java Runtime Environment (JRE) or extracts one if the host system lacks it, ensuring the Java-based payload runs regardless of system configuration.
## Indicators of Compromise
- **File Names:**
- `xeno.exe` (Initial loader)
- `decompiler.exe` (Obfuscated Java payload)
- Various `.lua` files used as decoys.
- **Network Indicators:**
- C2 communication typically involves hardcoded validation keys found in local configuration files bundled with the ZIP.
- [Example C2 patterns - Defanged]: `http[:]//[attacker-domain]/check`, `tcp[:]//[remote-ip]:[port]`
- **Behavioral Indicators:**
- Unexpected extraction of Java binaries to temporary directories.
- PowerShell processes spawned by an unknown executable named `decompiler.exe`.
- Network connections to non-standard ports originating from Java processes.
## Associated Threat Actors
- **Powercat:** Bitdefender associates this campaign with the group/malware previously identified by ThreatLocker as "Powercat," now featuring evolved C2 infrastructure and expanded stealing capabilities.
## Detection Methods
- **Signature-based detection:** Identify the `xeno.exe` loader and the specific JAR files used in the `decompiler.exe` wrapper.
- **Behavioral detection:** Monitor for unauthorized access to `%AppData%` folders (specifically Discord, Roblox, and Browser User Data) by unsigned or suspicious processes.
- **System Monitoring:** Flag any process attempting to capture screen content or activate the webcam outside of known communication apps.
## Mitigation Strategies
- **User Education:** Advise users against downloading game "executors," "cheats," or "injectors" from unofficial Discord servers or forums.
- **Application Whitelisting:** Use solutions like AppLocker or WDAC to prevent the execution of unsigned binaries in user-writable directories (e.g., `Downloads` or `AppData`).
- **Endpoint Protection:** Ensure EDR/AV solutions are active and configured to monitor for suspicious Java execution patterns.
## Related Tools/Techniques
- **RedLine Stealer:** Similar browser and crypto-theft capabilities.
- **Social Engineering:** Use of "Undetected Cheat" lures is a common technique used to target the gaming community.
- **Silly Stealer / Luna Grabber:** Other common script-based or Java-based stealers targeting Discord and gaming platforms.