Full Report
A malware campaign disguised as an “undetected” version of the Xeno Roblox script executor is directly affecting players looking to download a legitimate tool.
Analysis Summary
# Tool/Technique: Powercat (Fake Xeno Roblox Script Executor)
## Overview
This malware campaign involves a multi-stage Java-based infection chain disguised as a popular Roblox script executor named "Xeno." It targets gamers through Discord and community forums, promising "undetected" cheating capabilities. Once installed, it functions as a sophisticated Infostealer and Remote Access Trojan (RAT), specifically designed to target younger demographics by harvesting gaming accounts, social media credentials, and financial information.
## Technical Details
- **Type:** Infostealer / Remote Access Trojan (RAT)
- **Platform:** Windows (utilizes Java Runtime Environment)
- **Capabilities:** Credential theft, surveillance (webcam/desktop), keylogging, file manipulation, and remote shell execution.
- **First Seen:** Early 2024 (Activity surged in March 2024)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1204.002 - User Execution: Malicious File]
- **[TA0003 - Persistence]**
- [T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder]
- **[TA0005 - Defense Evasion]**
- [T1036.005 - Masquerading: Match Legitimate Name or Location]
- [T1497 - Virtualization/Sandbox Evasion]
- **[TA0009 - Collection]**
- [T1056.001 - Input Capture: Keylogging]
- [T1125 - Video Capture]
- [T1539 - Steal Web Session Cookie]
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
## Functionality
### Core Capabilities
- **Information Theft:** Extracts saved passwords and cookies from web browsers.
- **Account Hijacking:** Targets specific tokens and credentials for Discord, Roblox, and Minecraft.
- **Financial Theft:** Scans for cryptocurrency wallet data and payment-related information.
- **Persistence:** Establishes itself within the system by imitating legitimate Windows services, such as the Xbox Game Bar (GameDVR).
### Advanced Features
- **Surveillance:** Capable of streaming the victim's desktop in real-time and accessing the webcam.
- **Interactive Control:** Provides attackers with a remote PowerShell command-line interface.
- **Anti-Analysis:** Employs checks to detect if it is running in a virtual machine or sandbox environment to evade security researchers.
## Indicators of Compromise
- **File Hashes (MD5):**
- `259a376ea79411c5713beb396` (Archive containing fake Xeno)
- `2ead73ed62f1c2beb9043ce92e774e0b` (Malicious xeno.exe loader)
- `0aadd62b535e683a5a2fe31fde546d07` (Malicious xeno.exe loader)
- `d123dbb5c5980bfeb22586197d2cc403` (decompiler.jar)
- **File Names:** `xeno.exe`, `decompiler.jar`, `GameDVR.jar`
- **Network Indicators (Defanged):**
- `hxxps://solthere[.]net/justacoolkat10`
- `hxxps://solthere[.]net/api/v1/redeem`
- `ce953a0eb08246617b7f849486c4b26a7af37e9d2e8f0e13b3ae1bf0da8a70a[.]xyz`
- **Behavioral Indicators:** Unexpected Java processes running from AppData directories; modified registry keys in `Software\Microsoft\Windows\CurrentVersion\Run`.
## Associated Threat Actors
- Currently attributed to developers/operators of the **Powercat** malware family.
## Detection Methods
- **Signature-based:** Monitoring for the specific MD5 hashes of the `xeno.exe` and `decompiler.jar` payloads.
- **Behavioral:** Detecting unsigned Java applications attempting to access browser credential stores or sensitive gaming directories (e.g., `.roblox`, `.minecraft`).
- **Network:** Alerting on traffic to the identified C2 domains (`solthere[.]net`).
## Mitigation Strategies
- **User Education:** Advise users (particularly younger gamers) against downloading "undetected" cheats or scripts from unverified Discord servers or forums.
- **Application Whitelisting:** Restrict the execution of Java JAR files to known-good applications.
- **Credential Hygiene:** Implement Multi-Factor Authentication (MFA) on Discord, Roblox, and Minecraft accounts to prevent hijacking even if tokens are stolen.
## Related Tools/Techniques
- **Xeno (Legitimate):** The real Roblox script executor that this malware impersonates.
- **RedLine/Lumina Stealers:** Similar info-stealing families that use masquerading techniques to target gamers.