cyber.hendryadrian.com
Security News · securityaffairs.com

Microsoft Warns of RAT Delivered Through Trojanized Gaming Utilities

· Original article ↗

Summary

Microsoft researchers report a campaign using trojanized gaming utilities shared through browsers and chat platforms to deliver a RAT, establish persistence, and enable data theft and additional payload deployment.

Key points

  • Microsoft researchers say trojanized Xeno.exe and RobloxPlayerBeta.exe utilities were distributed through browsers and chat platforms.
  • A downloader used a portable Java runtime to execute a malicious JAR, with PowerShell and cmstp.exe used for stealth.
  • The downloader reportedly deleted itself, added Microsoft Defender exclusions, and established persistence through a scheduled task and startup script.
  • The final payload acted as a loader, downloader, runner, and remote access trojan.
  • The RAT connected to 79.110.49[.]15 for command and control, enabling data theft and further payload deployment.
  • Microsoft published indicators of compromise for the campaign.

Article Details

Event Type
Malware campaign distributing trojanized gaming utilities to deploy a remote access trojan.
Impact
The RAT connects to command-and-control infrastructure and can enable data theft and deployment of additional payloads. The campaign also establishes persistence and adds Microsoft Defender exclusions.

Indicators of compromise

TypeIndicatorContext
IPV479[.]110[.]49[.]15C2 IP address to which the campaign's RAT connects.

MITRE ATT&CK

T1053.005 · Scheduled TaskA scheduled task is used to establish persistence.T1059.001 · PowerShellPowerShell is used during the downloader's execution.T1070.004 · File DeletionThe downloader deletes itself.T1204.002 · Malicious FileUsers are lured into running trojanized gaming utilities.T1218.003 · CMSTPThe campaign uses cmstp.exe, identified in the article as a LOLBin, for stealth.T1562.001 · Disable or Modify ToolsThe campaign adds Microsoft Defender exclusions.

Vendors

MicrosoftMicrosoft Defender researchers uncovered a campaign that tricks users into running trojanized gaming utilities (Xeno.exe and RobloxPlayerBeta.exe) distributed through browsers and chat platforms, leading to the

Products

Microsoft Defender Antimalware PlatformMicrosoft Defender researchers uncovered a campaign that tricks users into running trojanized gaming utilities (Xeno.exe and RobloxPlayerBeta.exe) distributed through browsers and chat platforms, leading to the

Tools

cmstp.exeA malicious downloader used a portable Java runtime, PowerShell and LOLBins like cmstp.exe to run a harmful JAR, evade detection, establish persistence, and connect the RAT to C2 79.110.49[.]15 for data theft andPowerShellA malicious downloader used a portable Java runtime, PowerShell and LOLBins like cmstp.exe to run a harmful JAR, evade detection, establish persistence, and connect the RAT to C2 79.110.49[.]15 for data theft and

Related Articles