S
Version log only
Solara
ScriptBunker records 59% sUNC and version 0.1.7c. ScriptBlox shows the sUNC score moved from 53% to 59%. A partial score is a compatibility measurement, not a safety rating.
Public repository
GitHub- â–¾ xeno-executor/
- · xeno_injector.exe takes DLL as arg
- · xeno.dll mapped without LoadLibrary
- · lua/ runtime scripts
- · README.md build + usage notes
1// repository quick start
2run "xeno_injector.exe xeno.dll"
3press INSERT
Fake installer
Bitdefender- â–¾ xeno/ same structure
- ! xeno.exe malicious loader
- · lua/ real scripts, used as decoys
- ! decompiler.exe obfuscated payload
- · README.md same layout
1// observed chain
2xeno.exe → checks JRE
3decompiler.exe → downloads RAT
Sources: github.com/Animal2404/xeno-executor · Bitdefender Labs, August 2026. The comparison does not claim the repository is malware-free. It shows which file the fake installer replaced.
What the repository actually contains
The GitHub repository describes Xeno as an "internal Luau runtime for Windows x64" built in C++20. It maps its DLL without LoadLibrary, hooks lua_resume, and draws its interface over the game's swapchain.
The quick start instructions are specific: download the package, unpack it, run xeno_injector.exe with xeno.dll as the argument, press INSERT. The archive is password-protected, and the password is published on the repository page.
This is not hidden information. Anyone who can read the repository knows exactly which file is the injector, which is the DLL, and how they connect.
What Bitdefender found in the fake
Bitdefender's analysis describes a fake installer that mirrors the legitimate project's directory structure and includes real Lua scripts as decoys. The malicious component is xeno.exe — a loader, not the executor DLL.
The loader checks for Java Runtime Environment, extracts one if missing, reads command-and-control validation keys, and hands off to an obfuscated payload named decompiler.exe. That payload performs environment checks, registers the victim, and downloads the final RAT.
The RAT includes keylogging, screenshot capture every 500 milliseconds, webcam access, remote PowerShell execution, browser credential theft, Discord token theft, Roblox cookie theft, and cryptocurrency wallet targeting.
The comparison, side by side
| Attribute | Public repository | Fake installer |
|---|---|---|
| Directory structure | Injector, DLL, Lua scripts | Mirrors the same structure |
| Lua scripts | Part of the runtime | Included as decoys |
| Loader file | xeno_injector.exe | xeno.exe (malicious) |
| Payload location | DLL mapped without LoadLibrary | Java RAT downloaded after loader runs |
| Archive password | Published in repository | Not relevant — the user already ran the loader |
This table compares public descriptions. It does not claim the repository is safe. It shows that the fake installer replicated the structure while replacing the component that executes.
What this page does not claim
- This page does not claim the Xeno repository is malware-free. It compares public descriptions of a repository and a fake installer. It does not audit the binary.
- This page does not claim the repository's download folder is safe. The repository publishes a download path and an archive password. Whether the file at that path matches the source is not verified here.
- This page does not claim Xeno is currently working or detected. No tracker status for the repository build was found at review time.
Questions the comparison answers
Did Bitdefender say the real Xeno is malware?
No. The research describes fake Xeno installers. It documents what was distributed under the name, not what the public GitHub repository contains. The repository describes a manual-map loader and an injector. Those are different artifacts.
Why does the archive password matter?
The repository publishes the password in plain text. That means anyone who finds the repository can unpack the archive and see the file structure. An attacker who wants to impersonate the project knows exactly which files to include as decoys and which file to replace.
What is a manual-map loader?
It is a technique for loading a DLL into a process without calling LoadLibrary. The repository describes mapping the DLL manually and then hooking lua_resume to schedule scripts. The fake installer replaced the loader with a Java-based stealer that performs environment checks and downloads a RAT.
Where was the malware in the fake installer?
In xeno.exe — the loader, not the executor DLL. The fake installer included real Lua scripts as decoys, which meant a user who inspected the archive would see familiar file names and assume the package was legitimate. The malicious component ran before any executor code executed.
Does the repository publish a download link?
The repository references a "download folder" and publishes the archive password. This page does not embed that link. The Download button on this page is a placeholder until a source is verified.
Is a public repository the same as a verified source?
No. A public repository shows what the developer claims the code does. It does not prove that the file distributed through the download link was built from that code. The archive password makes the structure visible to anyone — including someone who wants to imitate it.
Related profiles
W
Tracker only
Wave
ScriptBlox records 100% sUNC and a team change from 2025. ScriptBunker marks the build Detected. Four signals, four different questions.
V
Tracker only
Volt
ScriptBlox records 100% sUNC and a rebrand from AWP.GG. A Triage score of 7/10 is the only independent signal.