Fake Xeno Roblox Executor — Java RAT/Infostealer Hunt Pack

Since the start of 2026, threat actors have distributed a trojanized version of Xeno, a popular third-party Roblox script-execution tool, through Discord servers, gaming forums, and compromised or impersonated accounts — advertised as an "undetected" build that bypasses Roblox's anti-cheat protections. Running the fake installer's xeno.exe quietly stages a Java Runtime Environment, launches an Allatori-obfuscated JAR disguised as decompiler.exe, and ultimately drops a full-featured Java-based RAT/infostealer into %LOCALAPPDATA%\Microsoft\GameDVR\ under a legitimate-sounding DLL name. Activity has been continuous since January 2026, surged sharply in the second half of March 2026, and was still being actively reported on by Bitdefender as recently as August 3, 2026.

The attacker's objective is broad, opportunistic account and asset theft — Discord, Roblox, Minecraft, and Microsoft Store credentials/payment tokens, plus cryptocurrency wallet data — monetized alongside full surveillance capability (keylogging, webcam access, live desktop streaming) and hands-on-keyboard remote access via an interactive PowerShell shell. Because the lure is a Roblox cheat tool, a meaningful share of victims are minors on shared family or BYOD computers, which raises both the privacy stakes and the odds that a compromised personal device also touches a managed or corporate environment.

The single highest-value defensive angle is upstream of any single stage: every step in the chain (the loader, the JRE, the obfuscated JAR, and the final payload) executes as an unsigned, low-prevalence binary from a user-writable AppData path. Blocking or alerting on that pattern (Hardening §12, Immediate tier) breaks the chain regardless of which filenames or hashes the operators rotate in next. The two confirmed C2 domain sets (solthere[.]net, powercat[.]dog) and the SHA-256-derived .xyz WebSocket root are also fully attributable and safe to block outright (IOC Appendix §10).

Eight sources were fetched and saved verbatim for this pack (snapshot files in XenoExecutor-RAT-Hunt-sources/, fetched 2026-08-09). Two are Tier-1 vendor primaries that independently confirm the same C2 root domain across two different campaign snapshots five months apart — the strongest single piece of corroboration in this research.

Suspicious-content check: every fetched source was reviewed for text that looked like it was trying to direct analyst/AI behavior (fake "system" instructions, requests to run commands, requests to fetch other URLs, claims of authority). None of the eight sources contained anything of that kind — all eight were straightforward threat-intelligence reporting, a vendor technical writeup, or a community forum discussion quoting that writeup.

Contradictions & gaps noted during research: the ThreatLocker page's raw text rendered one domain-list entry as ce9ce953a0eb08246617b7f849486c4b26a7af37e9d2e8f0e13b3ae1bf0da8a70a[.]xyz (an extra "ce9" prefix) immediately followed by the correctly-formatted subdomain entries (alpha[.]ce953a0eb..., etc.) — almost certainly a page-rendering/extraction artifact rather than a second real domain, since the clean 63-character root is independently confirmed byte-for-byte in the Bitdefender writeup. This pack uses only the clean, corroborated value. No IOC in this pack depends on the malformed string.

Hunt Hypotheses

1. Q1/Q2 (high fidelity): If the current campaign is active in our environment, we should see a hash match against the published sample set, or a process named xeno.exe executing from %LOCALAPPDATA%\Xeno\workspace\cache\.
2. Q3/Q4 (medium-high fidelity): We should see a javaw.exe/java.exe child process referencing decompiler.exe, preceded by a hidden PowerShell process silently extracting a JRE via ExtractToDirectory.
3. Q5 (high fidelity): We should see a registry Run-key or StartupApproved value literally named "Display Calibration" — not a real Windows or common third-party setting.
4. Q6 (high fidelity): We should see cmstp.exe spawned by a Java process — a UAC bypass attempt with no legitimate explanation in most fleets.
5. Q7 (high fidelity): We should see DNS resolution of solthere[.]net, powercat[.]dog, or the ce953a0eb...[.]xyz C2 root and its NATO-phonetic subdomains.
6. Q8 (high fidelity): We should see a process or file-write referencing one of the documented masquerading DLL names inside %LOCALAPPDATA%\Microsoft\GameDVR\ — a location none of those DLLs legitimately occupy.

Attack Chain

37 indicators total: 14 file hashes, 3 domains/DGA-roots, 4 URLs, 15 host/registry artifacts, and 1 legitimate-but-abused service pair (never block). Every atomic value below traces to a saved source snapshot in XenoExecutor-RAT-Hunt-sources/ — see References (§18).

Falcon's standard process/file/registry/network event model does not observe in-JVM behavior (sandbox checks, reflective class loading), COM/DirectShow interaction (webcam), raw Win32 keyboard hooks, or read/modify access to browser and application credential stores. The six checks below are the best available substitutes and are the honest complement to the Coverage Map gaps in §15 — they are not CQL and must be run through RTR, Sysmon, a licensed Falcon module, or your proxy/firewall layer instead.

RTR / OSQuery file-existence sweep

Falcon Real Time Response (or an OSQuery-based EDR) can directly check for artifact presence without a continuous detection: %LOCALAPPDATA%\Xeno\workspace\cache\, %LOCALAPPDATA%\Microsoft\GameDVR\, and a file named -ntcache or SquirrelInteractive.bin directly in the user profile root. None of these three names appear in a clean Windows profile.

Sysmon Event ID 11 (FileCreate) — companion telemetry

Where Sysmon runs alongside Falcon, filter FileCreate events for TargetFilename matching -ntcache, SquirrelInteractive.bin, or a modification timestamp on app.asar inside any installed Exodus Wallet directory — Falcon's canonical event list (crowdstrike-logscale-v3) has no generic file-create event for non-PE/non-archive file types, so this is a genuine telemetry gap Sysmon can close.

Sensitive Process Access (if licensed) / Sysmon Event ID 10 — credential-store and browser-process handle access

If the CrowdStrike Identity Protection / Sensitive Process Access module is licensed, or Sysmon ProcessAccess auditing is enabled, hunt for a javaw.exe/java.exe process opening a handle into chrome.exe, msedge.exe, brave.exe, opera.exe, vivaldi.exe, or Discord.exe — the browser-cookie and Discord-token theft T1555.003/T1528 gap flagged in the Coverage Map.

Windows Security Event 4688 — redundant process-creation cross-check

In estates where process-creation auditing with command-line logging is enabled (GPO: Audit Process Creation + Include command line in process creation events), Event 4688 gives a redundant, Falcon-independent copy of the Q2/Q3/Q4/Q6 process chains — useful for environments correlating into a separate SIEM.

DNS/proxy-layer DGA heuristic

At the firewall or web proxy (not endpoint telemetry), alert on outbound HTTPS/WebSocket connections to newly-registered .xyz domains whose hostname label is a 63–64 character lowercase hex string — a generic heuristic that would also have caught this campaign's C2 root before Bitdefender/ThreatLocker published it by name.

Unmanaged per-user JRE inventory sweep

Query your software-inventory/RMM tooling for a Java Runtime Environment present under any user's %LOCALAPPDATA% that did not arrive via a managed software-deployment channel (Ninja, SCCM, Intune). An unexpected per-user JRE is a weak but cheap signal worth a periodic sweep, since every stage of this malware depends on one being present.

Alert Package — Primary Detection (Q2 → Q3 Loader Chain)

alert-builder-v2 output for the highest-signal composite detection. Folded into this section per the standard 18-section layout, since Custom IOA Recommendations is the closest operational home for scheduled-search + alert-email content.

Scheduled Search Configuration (LogScale UI)

NAME:
HUNT: Fake Xeno Roblox Loader - Java RAT Stage 1/2 Execution Chain

DESCRIPTION:
Detects the fake Xeno Roblox script-executor loader chain: a process named xeno.exe running from a staged AppData workspace directory, followed within seconds by a javaw.exe/java.exe child process whose command line references a JAR disguised as decompiler.exe. This is the stage-1-to-stage-2 handoff of a Java-based RAT/infostealer distributed as a trojanized "undetected" Roblox cheat tool via Discord and gaming forums, active since early 2026.

MITRE: T1204.002 (User Execution: Malicious File), T1036.008 (Masquerading: Masquerade File Type), T1027 (Obfuscated Files or Information)
Tactics: Execution, Defense Evasion
Priority: HIGH (escalate immediately if the chain reaches stage 3 — a file write or execution referencing %LOCALAPPDATA%\Microsoft\GameDVR\ — or if a Run-key value named "Display Calibration" appears)
FP Sources: the genuine, non-trojanized Xeno Roblox executor (filename/path collision — see Q2 FP notes); legitimate Java decompiler tooling on developer workstations (JD-GUI, CFR, Procyon — see Q3 FP notes)

Alert Package (sent when the scheduled search fires)

SUBJECT:
🚨 HUNT ALERT 🚨 — Fake Xeno Roblox Loader Detected (Possible RAT/Infostealer Staging)

BODY:
A process named xeno.exe executed from %LOCALAPPDATA%\Xeno\workspace\cache\ and was followed by a javaw.exe/java.exe child process referencing decompiler.exe — the documented stage-1-to-stage-2 handoff of a Java-based RAT/infostealer masquerading as an "undetected" Roblox cheat tool (Bitdefender, Aug 2026; ThreatLocker, Mar 2026). This alert fires on execution, not just a blocked attempt — treat it as active unless #event_simpleName confirms otherwise. Check first: whether SHA256HashData/MD5HashData matches the known-bad hash list (Q1 — if yes, this is a confirmed detonation, not a legitimate-tool collision), the full ImageFileName path of both stage-1 and stage-2 processes, and whether a follow-on write/exec referencing %LOCALAPPDATA%\Microsoft\GameDVR\ has already occurred (stage 3 — full RAT capability is live).

Investigation Checklist

1. Blocked or executed? Check #event_simpleName — ProcessBlocked means Falcon stopped it, ProcessRollup2/SyntheticProcessRollup2 means it ran.
2. Check SHA256HashData/MD5HashData against the Q1 known-sample list — a match means this is a confirmed detonation and skips the legitimate-tool ambiguity entirely.
3. Confirm the child-process chain: does the xeno.exe hit have a javaw.exe/java.exe child within seconds? No child chain + no hash match = likely just the genuine Xeno tool (AUP matter, not RAT).
4. Search the same aid/host for any hit on Q5 (Run key "Display Calibration"), Q6 (CMSTP from Java), or Q8 (GameDVR masquerade) in the following 5 minutes — any of these confirms stage 3 has landed and full RAT capability (keylogging, webcam, remote shell) is live.
5. Search the same aid/host on Q7 for DNS/network activity to solthere[.]net, powercat[.]dog, or the *.ce953a0eb...xyz C2 root — confirms live C2 contact.
6. Check the logged-on UserName and whether this is a managed corporate asset or a BYOD/personal device — shapes the containment and user-notification path.
7. Check frequency environment-wide (groupBy ComputerName): a single host is a targeted/opportunistic infection; many hosts lighting up in a short window suggests a shared-download source (e.g., a compromised Discord server link) worth a broader user-comms push.
8. Isolate if: execution confirmed (not just blocked) AND (hash match OR the stage-3/persistence/C2 chain above is present). Do not wait for webcam/keylogger confirmation — by the time that's visible the RAT is already fully live.

Pivot Queries

Query 1 — Confirm the full stage-1/stage-2 process chain on this host

>> YOU NEED:  ComputerName (from the alert)
              Alert timestamp (from the alert — set LogScale window to ±10 min)
>> FILL IN:   ComputerName="REPLACE_WITH_HOSTNAME"

Host-scoped

#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ComputerName="REPLACE_WITH_HOSTNAME"
| FileName=/^(xeno|javaw?|cmstp)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData, aid])
| sort(@timestamp, order=asc)

Environment-wide

#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(xeno|javaw?|cmstp)(\.exe)?$/i
| CommandLine=/decompiler|GameDVR/i
| groupBy([ComputerName], function=[count(as=Hits), collect(CommandLine)])
| sort(Hits, order=desc, limit=200)

Query 2 — Check for stage-3 persistence ("Display Calibration") on this host

>> YOU NEED:  ComputerName (from the alert)
>> FILL IN:   ComputerName="REPLACE_WITH_HOSTNAME"

Host-scoped

#event_simpleName=/AsepValueUpdate|RegGenericValueUpdate/
| ComputerName="REPLACE_WITH_HOSTNAME"
| RegValueName="Display Calibration"
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, aid])

Environment-wide

#event_simpleName=/AsepValueUpdate|RegGenericValueUpdate/
| RegValueName="Display Calibration"
| groupBy([ComputerName], function=count(as=Hits), limit=200)
| sort(Hits, order=desc)

Query 3 — Check for live C2 contact on this host

>> YOU NEED:  ComputerName (from the alert)
              Alert timestamp (from the alert — set LogScale window to ±10 min)
>> FILL IN:   ComputerName="REPLACE_WITH_HOSTNAME"

Host-scoped

#event_simpleName=DnsRequest
| ComputerName="REPLACE_WITH_HOSTNAME"
| DomainName="solthere.net" or DomainName=/\.solthere\.net$/i or DomainName="powercat.dog" or DomainName=/\.powercat\.dog$/i or DomainName=/(^|\.)ce953a0eb08246617b7f849486c4b26a7af37e9d2e8f0e13b3ae1bf0da8a70a\.xyz$/i
| table([@timestamp, ComputerName, UserName, DomainName, aid])

Environment-wide

#event_simpleName=DnsRequest
| DomainName="solthere.net" or DomainName=/\.solthere\.net$/i or DomainName="powercat.dog" or DomainName=/\.powercat\.dog$/i or DomainName=/(^|\.)ce953a0eb08246617b7f849486c4b26a7af37e9d2e8f0e13b3ae1bf0da8a70a\.xyz$/i
| groupBy([ComputerName], function=count(as=Hits), limit=200)
| sort(Hits, order=desc)

Query 4 — Environment-wide frequency (single host vs. broad spread)

Environment-wide

#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^xeno(\.exe)?$/i
| ImageFileName=/\\Xeno\\workspace\\cache\\/i
| groupBy([ComputerName], function=count(as=TotalHits), limit=500)
| sort(TotalHits, order=desc)

Telemetry Ready

Confirm ProcessRollup2/SyntheticProcessRollup2, DnsRequest, AsepValueUpdate/RegGenericValueUpdate, and JarFileWritten are enabled in the sensor policy for the target host groups. Identity Protection licensing is not required for this pack.

Benign Baseline

Run Q2, Q3, Q4, and Q8 once with a wide time window and no expectation of hits, to confirm zero baseline noise in your environment before relying on them operationally. Flag Q3 specifically if your fleet has developers who legitimately run Java decompiler tooling — that is the one query most likely to have a non-zero benign baseline.

Positive Tests (isolated/canary endpoint only, benign payloads only)

• Q5: write a registry value literally named Display Calibration under HKCU\Software\Microsoft\Windows\CurrentVersion\Run on a test endpoint, confirm the query fires, then delete the test value.
• Q6: from a test Java wrapper process on an isolated VM, launch cmstp.exe against a benign .inf profile, confirm the query fires, then remove the test profile.
• Q7: from a test endpoint, run nslookup solthere.net or nslookup powercat.dog — a bare DNS lookup is safe and does not require running any malicious code, and it should surface in the query within minutes.
• Q1/Q2/Q3/Q8: do NOT detonate the real sample to validate these. Substitute the SHA256 of a known-benign test binary into Q1's hash list temporarily, or rely on the Q5/Q6/Q7 tests above as sufficient end-to-end validation of the detection pipeline.

Promotion

Q5 and Q6 are safe Detect→Block Custom IOA promotion candidates after a 14-day clean canary run. Q7 promotes to Block once you've confirmed your DNS/proxy layer doesn't already own domain blocking upstream. Q2 and Q3 stay in Detect-only mode indefinitely — both carry a documented legitimate-tool collision risk (see their FP notes) that makes Block mode inappropriate regardless of canary results.

TTP: Fake Xeno Roblox Executor → Java RAT/Infostealer ("Powercat")   Primary Mitigations: M1038, M1040, M1042, M1047, M1021, M1043, M1017

Step 1 — Block unsigned, low-prevalence executables from user-writable AppData paths (ASR rule)

What it does: Enables the Microsoft Defender Attack Surface Reduction rule that blocks execution of unsigned/low-prevalence executables — the exact category xeno.exe, the staged JRE launcher, and the GameDVR-dropped payload fall into.

Why it works: MITRE M1038 — this is prevention at the single weakest, earliest, and most consistent point in the entire attack chain.

Prerequisites: Windows 10 1709+ / Windows 11; Microsoft Defender Antivirus present and active (can run in passive/EDR-block mode alongside Falcon as primary AV — confirm your environment's AV-arbitration policy before enabling).   Reboot required: No.

Stage 1: enable in Audit mode, confirm no legitimate business software gets flagged over 1-2 weeks, then flip to Block.

# Stage 1 — Audit mode (observe only, no blocking)
Add-MpPreference -AttackSurfaceReductionRules_Ids 01443614-cd74-433a-b99e-2ecdc07bfc25 `
  -AttackSurfaceReductionRules_Actions AuditMode

# Stage 2 — after reviewing Windows Defender ASR audit events (Event ID 1122) for 1-2 weeks
# with no legitimate business software flagged, promote to enforcement:
Add-MpPreference -AttackSurfaceReductionRules_Ids 01443614-cd74-433a-b99e-2ecdc07bfc25 `
  -AttackSurfaceReductionRules_Actions Enabled

GPO path (if applicable):
Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack Surface Reduction > Configure Attack Surface Reduction rules

Verify:

Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids

Rollback: Add-MpPreference -AttackSurfaceReductionRules_Ids 01443614-cd74-433a-b99e-2ecdc07bfc25 -AttackSurfaceReductionRules_Actions Disabled

Step 2 — Enable PowerShell Script Block Logging + Module Logging

What it does: Turns on Event ID 4104 (script block) and 4103 (module) logging so hidden/obfuscated PowerShell — including the JRE-extraction command this loader runs and any attacker-issued Base64 command sent later over the C2 channel — is captured in full, decoded text.

Why it works: MITRE M1042 + M1047 — directly closes the T1059.001 telemetry gap flagged in the Coverage Map for attacker-issued PowerShell.

Prerequisites: Windows PowerShell 5.0+ / PowerShell 7.x; delivered via GPO or direct registry push through your RMM tooling.   Reboot required: No — new PowerShell sessions pick up the policy immediately; already-open sessions are unaffected until restarted.

Registry push (RMM/local) equivalent to the GPO below.

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" /v EnableModuleLogging /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames" /v "*" /t REG_SZ /d "*" /f

GPO path (if applicable):
Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > "Turn on PowerShell Script Block Logging" = Enabled; "Turn on Module Logging" = Enabled (Module Names = *)

Verify:

Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" -MaxEvents 5   # confirm 4104 events are populating

Rollback: reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /f (repeat for the ModuleLogging key), or set the corresponding GPO back to Not Configured.

Deploying via your RMM

The scripts above are raw PowerShell/registry. To wrap them for RMM fleet deployment (admin check, error handling, custom-field writeback for compliance tracking), hand them to your RMM deployment tooling and ask for a deployable package.

Coverage summary: 5 of 12 mapped technique rows have Good coverage, 2 Partial, 5 GAP. The GAP rows are concentrated entirely in the RAT's surveillance and credential-theft subsystem (keylogging, screenshot/webcam capture, browser/Discord/Roblox/Minecraft/wallet credential theft) and in-process JVM behavior (sandbox evasion, reflective class loading) — none of which standard Falcon process/file/registry/network telemetry observes directly. This is an honest capability boundary, not a missing query: §7 (Native Audit-Log Hunts) documents the best available partial mitigations (Sysmon, Sensitive Process Access if licensed, DNS-layer DGA heuristics), and §12 (Hardening) closes the loader-execution gap upstream of all of it.

Priority gap: T1555.003/T1528/T1005 (credential and account theft) is the highest-impact GAP — it is the actual monetization step for the attacker and the actual harm to the victim, and it has no direct CQL detection surface in a standard Falcon deployment.

All sources fetched and saved verbatim to XenoExecutor-RAT-Hunt-sources/ on 2026-08-09 for provenance. No prompt-injection or instruction-like content was observed in any fetched source.