Trojanized Gaming Tools Deliver Stealthy RAT: Uncovered by Microsoft Researchers

CyberDefender 5 mins0

Security researchers at Microsoft Defender have uncovered a sophisticated malware campaign targeting gamers and casual users through trojanized gaming utilities. What appears to be harmless tools like Xeno.exe or RobloxPlayerBeta.exe are, in reality, the first step in a multi-stage infection chain that culminates in a fully functional Remote Access Trojan (RAT).

Here’s a technical breakdown of how the attack works — and what defenders should watch for.

Initial Access: Trojanized Gaming Utilities

Threat actors distributed malicious executables disguised as legitimate gaming tools through:

  • Web browsers (drive-by downloads)
  • Chat platforms and community sharing sites

Victims were tricked into running:

  • Xeno.exe
  • RobloxPlayerBeta.exe

Once executed, the files launched a malicious downloader, initiating the next stage of compromise.

Stage 2: Java-Based Payload Delivery

The downloader demonstrated layered stealth techniques:

  1. Staged a portable Java runtime
  2. Executed a malicious JAR file named: jd-gui.jar
  3. Leveraged PowerShell and living-off-the-land binaries (LOLBins), notably:
    • cmstp.exe (Connection Manager Profile Installer)

Using legitimate system tools for execution allowed the attacker to blend in with normal system activity and evade detection.

Defense Evasion Techniques

This campaign employed several anti-detection measures:

  • Deleted the initial downloader after execution
  • Added Microsoft Defender exclusions for RAT components
  • Used LOLBins to avoid introducing obvious malicious binaries
  • Created persistence mechanisms:
    • Scheduled task with randomized name
    • Startup script: world.vbs

These tactics significantly reduce forensic visibility and extend attacker dwell time.

Final Payload: Multi-Function RAT

The deployed malware acted as:

  • Loader
  • Runner
  • Downloader
  • Remote Access Trojan (RAT)

It established command-and-control (C2) communication with:

79.110.49[.]15
powercat[.]dog:443

Once connected, attackers gained capabilities including:

  • Credential theft
  • Data exfiltration
  • Additional payload deployment
  • Remote command execution

This makes the infection highly flexible and adaptable to follow-on attacks.

Indicators of Compromise (IOCs)

Security teams should monitor for the following artifacts:

FileSHA-256
decompiler.exe48cd5d1ef968bf024fc6a1a119083893b4191565dba59592c541eb77358a8cbb
jd-gui.jara33a96cbd92eef15116c0c1dcaa8feb6eee28a818046ac9576054183e920eeb5
worldview.db-wal / StandardName.exe4442ba4c60a6fc24a2b2dfd041a86f601e03b38deab0300a6116fea68042003f
world.vbs65f003998af7dd8103607c8e18ef418b131ba7d9962bd580759d90f4ac51da36

Network indicators:

  • 79.110.49[.]15
  • powercat[.]dog:443

Mitigation & Response Recommendations

Organizations should immediately implement the following defensive measures:

1. Network Controls

  • Block or monitor outbound traffic to identified IPs/domains
  • Alert on downloads of:
    • java[.]zip
    • jd-gui.jar
      from non-corporate sources

2. Threat Hunting

  • Search for suspicious process chains involving:
    • PowerShell
    • cmstp.exe
    • Java runtime execution from non-standard paths
  • Hunt for scheduled tasks with randomized or suspicious names

3. Endpoint Hardening

  • Audit Microsoft Defender exclusions
  • Remove unauthorized exclusions
  • Review startup folders for malicious scripts (e.g., world.vbs)

4. Incident Response

If compromise is confirmed:

  • Isolate affected endpoints immediately
  • Collect EDR telemetry
  • Reset credentials used on compromised systems
  • Conduct lateral movement analysis

Key Takeaways

This campaign highlights several recurring threat trends:

  • Targeting gamers as a high-risk demographic
  • Multi-stage payload delivery chains
  • Heavy use of LOLBins for stealth
  • Tampering with security controls for persistence

Security teams must remain vigilant against malware disguised as legitimate utilities — especially those distributed through informal channels like chat groups and gaming communities.

The combination of social engineering, living-off-the-land execution, and layered persistence mechanisms makes this campaign particularly dangerous.

CyberDefender