XenoRAT Disguised as Roblox Tools Spreads Through .gg Domains and GitHub
Summary
Hunt researchers found XenoRAT and other malware distributed through .gg command-and-control domains and a GitHub account posing as a Roblox scripting-tool source, with a video urging users to disable Windows Defender.
Key points
- XenoRAT samples communicated with controllers hosted on .gg domains; researchers identified seven examples and associated IP addresses and file hashes.
- A GitHub repository presenting itself as a source for Roblox scripting tools contained XenoRAT and Quasar RAT samples; related files were also flagged as XWorm.
- One shared IP address had also hosted infrastructure for DcRAT, VenomRAT, and Redline Stealer, according to the article.
- A YouTube video linked by naming similarities instructed viewers to disable Windows Defender before installing a purported Synapse X file.
- Hunt said it was monitoring XenoRAT infrastructure on its default port, 4444, and planned to expand monitoring to other ports.
Article Details
- Attack Vectors
- XenoRAT and other malware were distributed through .gg domains acting as controller infrastructure.
- A GitHub account presented malicious executables and archives as Roblox scripting or executor tools.
- A YouTube video instructed users to disable Windows Defender before installing a Synapse X archive; commenters vouched for the files and dismissed warnings.
- The Synapse X archive contained XenoRAT and Quasar samples. A separate repository file was reported by a GitHub user as XWorm malware.
- XenoRAT communicated with clients over TCP sockets. The article says its C2 servers respond in a recognizable pattern and notes default-port monitoring on port 4444.
- Defensive Notes
- Hunt reports scanning for XenoRAT infrastructure on its default port, 4444, and plans to expand monitoring to all ports.
- The article recommends network IDS rules, including Suricata and Snort, to detect the servers.
- Users should exercise caution before downloading and installing software, including game-related tools.
- The article describes instructions to disable Windows Defender as part of the malicious software installation video.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | anyone-blogging[.]gl[.]at[.]ply[.]gg | XenoRAT C2 domain listed for the Synapse X Launcher.exe.exe sample. |
| SHA1 | 029f3396c39f543dd984031eb82edcc035ed0a25 | SHA1 of the executable sample associated with a listed XenoRAT controller. |
| SHA1 | 2051551c6c0f18eaf3c4cf45ffe6119e582c19ae | SHA1 of the SynapseX.revamaped.V1.2.rar sample associated with the listed XenoRAT controller. |
| SHA1 | 33ac2b2d228a1ec93b0ea70ffadb436933b9a1e5 | SHA1 of the Quasar sample listed as OOO GETWIFI. |
| SHA1 | 38ce2a41d59a1bf0f3332fb867f43794c39577af | SHA1 of the Client.exe sample associated with a listed XenoRAT controller. |
| SHA1 | 5e7138c7ee8a1de9d041804fd11ac0ba63cb1f34 | SHA1 of the WavePreTest.rar sample associated with a listed XenoRAT controller. |
| SHA1 | 707c68257c2ea97fa4591f58be326e1308fd1106 | SHA1 of the xeno.exe sample associated with a listed XenoRAT controller. |
| SHA1 | 7c7408870da2fe079aa460fe0d237e12e19cb7cb | SHA1 of the Synapse X Launcher.exe.exe sample identified as XenoRAT. |
| SHA1 | af68a0b9e9c58dcbdd2ede205c30537bca39650c | SHA1 of the NeikiAnalytics.exe sample associated with a listed XenoRAT controller. |
| SHA1 | e9251ef1dd3ebe4f17acf0b3552e22751009c8c1 | SHA1 of the testingrat.exe sample associated with a listed XenoRAT controller. |
| SHA256 | a3254b90b2c6e12c29f7d9f538087da2d4bb7f64d003c591c8936cee7dd74b39 | Hash presented as the filename of an executable associated with a listed XenoRAT controller. |
People
Threat Actors
Malware
DCRatMethods LLC ASN in the U.S. Notably, IP 147.185.221_19 also served as controller infrastructure for DcRAT and VenomRAT, as seen in Figure 3. Additionally, this same IP hosted a C2 server for Redline Stealer justQuasarand Synapse X Launcher.exe. The first file is identified as XenoRAT, while the latter is detected as Quasar, a well-known malware family also written in .NET. Sandbox results for both files are displayed below.RedLine Stealerfor DcRAT and VenomRAT, as seen in Figure 3. Additionally, this same IP hosted a C2 server for Redline Stealer just last month.VenomRATLLC ASN in the U.S. Notably, IP 147.185.221_19 also served as controller infrastructure for DcRAT and VenomRAT, as seen in Figure 3. Additionally, this same IP hosted a C2 server for Redline Stealer just last month.XenoRATXenoRAT, an open-source malware available on GitHub, has been linked to a North Korean hacking group and unnamed threat actors preying on the gaming community. Recently, Hunt’s Research Team discovered the remote accessXWormwith screenshots from Hatching Triage, indicating that the file in the XMainDab folder was detected as XWorm malware. Figure 7 includes a screenshot of the comment and the analysis images.
Products
Robloxesports, and a GitHub repository portraying its software as scripting engine tools for the popular game Roblox.Windows Defender& Quasar DistributionFigure 9 shows a screenshot from one of the videos instructing users to disable Windows Defender before installing the Synapse X RAR file. Notably, the screenshot reveals that the user's Windows
Tools
SnortController Communication (Source Hatching Triage)If you're in need of robust network IDS rules (Suricata/Snort) to detect these servers, check out @Jane0sint’s contributions on the Emerging Threats website.Suricata-> Controller Communication (Source Hatching Triage)If you're in need of robust network IDS rules (Suricata/Snort) to detect these servers, check out @Jane0sint’s contributions on the Emerging Threats website.
Countries
North KoreaMost recently, AhnLab’s ASEC reported on a likely North Korea-linked group using Dropbox to deliver Xeno RAT to victim networks. In late April, a third-party researcher on X posted on an open directory likelyUnited Statesdomain was hosted on one of three shared IP addresses belonging to the Developed Methods LLC ASN in the U.S. Notably, IP 147.185.221_19 also served as controller infrastructure for DcRAT and VenomRAT, as seen in