Is Xenos_2.3.2_[unknowncheats.me]_.7z safe?
The archive contains confirmed Xenos/BlackBone injection tooling, with 46 of 75 engines flagging it and runtime evidence showing execution from a temporary directory.
The archive is consistently identified as Xenos/BlackBone injection tooling: 46 of 75 engines flagged it, including 10 tier-1 detections and several corroborated hacktool labels. Runtime evidence also shows extracted executables launching from a temporary directory, an endpoint-protection impairment technique, and a persistence-related registry indicator.
06b12c6d7ece840a3b…6c7395b3138badRecommended next actions
Before opening or extracting
Do not open or extract it. Delete this archive from the device, then empty the Recycle Bin or Trash.
If you already opened or extracted it
Close it. If it opened links, requested credentials, or triggered unexpected behavior, disconnect from the internet and run a full device scan.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
The archive is consistently identified as Xenos/BlackBone injection tooling: 46 of 75 engines flagged it, including 10 tier-1 detections and several corroborated hacktool labels. Runtime evidence also shows extracted executables launching from a temporary directory, an endpoint-protection impairment technique, and a persistence-related registry indicator.
A broad detection set flags the archive, with 46 of 75 engines reporting concerns and 10 tier-1 detections. Multiple independent products specifically identify BlackBone, BlaXeno, Xenos, or DLL-injection functionality, and the confirmed-hacktool threshold is satisfied. The completed runtime observation launched Xenos executables from a temporary directory and recorded T1562.001 plus a persistence-related registry path. One YARA rule also matched obfuscation or hiding characteristics, though that rule can generate false positives. The host-reputation cross-check was not saved, and none of the seven extracted children received a conclusive child verdict, but those limitations do not outweigh the corroborated offensive-tool evidence.
What We Detected
46 of 75 antivirus engines flagged this archive, including 10 tier-1 detections. Microsoft identified BlaXeno, DrWeb and Sophos identified BlackBone, and several other products explicitly labeled the contents as Xenos, an injector, or a hacktool. These corroborated labels satisfy the confirmed-hacktool threshold.
Threat Behavior
The completed sandbox run extracted and launched Xenos.exe and Xenos64.exe from a temporary directory. It recorded T1562.001, a technique involving impairment of security controls, and a persistence-related registry indicator. The YARA rule Sus_Obf_Enc_Spoof_Hide_PE also matched obfuscation or hiding characteristics. One external IP was observed, but no complete host-reputation result is available, so its role cannot be determined from this evidence.
What To Do Now
Do not extract or execute the archive on a normal system. Keep endpoint protection enabled, quarantine or remove the file, and investigate the machine for the extracted Xenos executables and related registry changes if it has already run.
Where this verdict could be wrong4 caveats
- The archive is established rather than newly observed: prevalence records 3,253 sources and 4,726 submissions since 2018.
- behaviour.hasMaliciousSandboxVerdict=false, so the single completed sandbox run did not issue an explicit malware verdict.
- droppedChildren.hasMaliciousChild=false, but all 7 inspected children have unknown verdicts rather than confirmed clean results.
- Several detections describe the contents as a PUA or injection tool rather than a conventional trojan, including Sophos BlackBone (PUA) and ESET Win32/DllInject.LJ potentially unsafe application.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The file has been widely submitted since 2018 rather than appearing recently
- No explicit malicious sandbox verdict was issued
- No extracted child was confirmed malicious, although all seven child verdicts remain unknown
- 46 of 75 engines reported a detection
- 10 tier-1 engines flagged the archive
- Confirmed hacktool and injector labels across multiple engines
- Runtime execution of Xenos.exe and Xenos64.exe from a temporary directory
- T1562.001 endpoint-protection impairment technique recorded
- Persistence-related registry indicator observed
Quarantine and remove the archive without extracting it, and keep antivirus and endpoint protection enabled. If executed, inspect the temporary directory, related Xenos executables, and persistence-related registry changes.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete46 of 75 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Partial1 runtime contact was observed without a completed reputation cross-check.
YARA
Complete4 signature or behavior rules matched.
External intel
Complete3 of 3 independent reference sources completed.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime flight recorder
Capture complete- 1isolated sandbox run
- 11MITRE ATT&CK techniques
- 7spawned processes
- 1network contacts
- 9filesystem & mutex artifacts
What this file does
Observed actions and their security significance
High concern: Used an input-capture technique that can record credentials or keystrokes.
High concern: Changed an auto-start location that can make code run after sign-in or restart.
High concern: Attempted to impair or bypass security controls.
High concern: Manipulated how the operating system loads code, which can redirect execution.
Moderate concern: Communicated over a common application protocol; malware can use this for command-and-control.
Moderate concern: Checked the environment for virtualisation or analysis tools.
Note: Collects details about your system.
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
Threat context
How hacktools are abused
This is a hacking or cracking tool — the kind used to bypass software licences, generate fake keys, or attack other systems. Even when the tool 'works', these downloads very often carry hidden malware.
Bottom line:Running one means trusting an anonymous author with full access to your PC — rarely worth the risk.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
Xenos_2.3.2_[unknowncheats.me]_.7z
06b12c6d7ece840a3b805e7a498a4af695f793a053a63b887f6c7395b3138bad
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
"C:\Users\<USER>\AppData\Local\Temp\Xenos.exe"
02Isolated runtime analysis - ProcessObserved
Observed process
"C:\Users\<USER>\AppData\Local\Temp\Xenos64.exe"
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Files
Created or changed
- Written fileObserved
Xenos.log
C:\Users\<USER>\Desktop\Xenos.log
04Isolated runtime analysis - Written fileObserved
dly0wuad.wl2
C:\Users\user\AppData\Local\Temp\dly0wuad.wl2
05Isolated runtime analysis - +1 more recorded observation in Analyst mode
Network
Hosts contacted
- Contacted hostObserved
142.251.183.94
Contact observed during runtime.
06Isolated runtime analysis
6 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 142.251.183.94
- \\Registry\Machine\Software\Classes\XenosProfile\shell\Run\command\(Default)
- HKU\S-1-5-21-575823232-3065301323-1442773979-1000\Software\WinRAR\Interface\Themes\ShellExtIcon
- HKU\S-1-5-21-575823232-3065301323-1442773979-1000\Software\WinRAR\Interface\Themes\ShellExtBMP
- \\REGISTRY\A\{e5496b73-319c-11ec-adfa-167c9a143b0a}\DefaultObjectStore\ObjectTable\661\Indexes\FileIdIndex-{853201e6-2d75-11ea-a138-806e6f6e6963}\2F00000000061F
- \\Registry\Machine\Software\Classes\.xpr\Content Type
- \\Registry\Machine\Software\Classes\.xpr\(Default)
- \\REGISTRY\A\{e5496b73-319c-11ec-adfa-167c9a143b0a}\DefaultObjectStore\LruList\0000000000002B6C\ObjectLru
- C:\Users\<USER>\Desktop\Xenos.log
- C:\Users\user\AppData\Local\Temp\dly0wuad.wl2
- C:\Users\user\AppData\Local\Temp\dly0wuad.wl2\Changelog.txt
- C:\Users\user\AppData\Local\Temp\dly0wuad.wl2\Readme.txt
- C:\Users\user\AppData\Local\Temp\dly0wuad.wl2\Xenos.exe
Files this sample writes at runtime
This file drops 7 children at runtime. None are currently flagged malicious in our cache.
- 8bdb3ce10dee7a3249a1…49a07bNever scannednever seen before
- 0e6d59fcdf8f143e23b0…b76eb9Never scannednever seen before
- 9760b735a55147ba0b2c…0246e7Never scannednever seen before
- 6f0a8d0b2eed24cadb3f…7ef3d6Never scannednever seen before
- cd0defdf5284d70ecd63…1bd0aaNever scannednever seen before
- 23cb7d25614bfe8169d8…e35799Never scannednever seen before
- f0452ee6e75458f065e1…8ff0f3Never scannednever seen before
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 4rule hits recorded
- 46 / 75engines flagged
- 3,253sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
2 high-confidence signature or behavior rules matched this file.
Verdict inputView chapterProvenanceDerivedSourceSignature and behavior rulesObserved at - 02
46 of 75 antivirus engines flagged the file, including alibabacloud and ALYac.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 03
The hash has a long, established submission history across 3,253 sources.
ProvenanceDerivedSourceSubmission historyObserved at - 04
Scanned file: Xenos_2.3.2_[unknowncheats.me]_.7z — 06b12c6d7ece840a3b805e7a498a4af695f793a053a63b887f6c7395b3138bad
ProvenanceObservedSourceUploaded fileObserved at - 05
Observed process — "C:\Users\<USER>\AppData\Local\Temp\Xenos.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
Observed process — "C:\Users\<USER>\AppData\Local\Temp\Xenos64.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 07
File written: Xenos.log — C:\Users\<USER>\Desktop\Xenos.log
ProvenanceObservedSourceIsolated runtime analysisObserved at - 08
File written: dly0wuad.wl2 — C:\Users\user\AppData\Local\Temp\dly0wuad.wl2
ProvenanceObservedSourceIsolated runtime analysisObserved at - 09
Contacted host: 142.251.183.94 — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
Category: hacktool
One or more independent reference databases matched this hash.
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
- Sus_Obf_Enc_Spoof_Hide_PE
Sandbox flagged persistence indicators (registry Run keys / services / scheduled tasks).
Evidence\\Registry\Machine\Software\Classes\XenosProfile\shell\Run\command\(Default)Unsigned sample writes to AppData/Temp/ProgramData AND creates a Run key. Textbook user-mode persistence — legit installers sign their binaries.
EvidenceC:\Users\user\AppData\Local\Temp\dly0wuad.wl2 → \\Registry\Machine\Software\Classes\XenosProfile\shell\Run\command\(Default)The sample contacted an external IP address directly and no application domain was recorded. Direct-IP traffic also occurs in legitimate installers and infrastructure, so this is supporting context only and requires corroboration from host reputation and other runtime evidence.
Evidence142.251.183.94
46 of 75 engines flagged this file
View all 75 engine results
PE structure
Not applicablePE structure analysis applies to Windows executable formats, not this file type.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Fingerprint and provenance
- File name
- Xenos_2.3.2_[unknowncheats.me]_.7z
- Format
- 7ZIP
- Code signing
- Not applicable to this file type
- Size
- 702.6 KB
- Last analyzed
- Sep 28, 2026, 11:57 PM UTC
06b12c6d7ece840a3b805e7a498a4af695f793a053a63b887f6c7395b3138badSafety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
This file is dangerous. Treat it as harmful and remove it.
- Recovery step 01
Don't open or extract this archive. Delete this archive from the device, then empty the Recycle Bin or Trash.
- Recovery step 02
If you already opened or extracted it, disconnect from the internet and start with a full antivirus scan or Microsoft Defender Offline scan. If compromise is suspected or the problem persists, use a reputable second-opinion scanner and follow incident-recovery or clean-reinstall guidance.
- Recovery step 03
From a different, clean device, change the passwords on your important accounts (email and banking first) and turn on two-factor authentication.
- Recovery step 04
Get a fresh copy from the original trusted source and verify its exact hash when possible.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is Xenos_2.3.2_[unknowncheats.me]_.7z malware?
What is Xenos_2.3.2_[unknowncheats.me]_.7z?
How many antivirus engines detected Xenos_2.3.2_[unknowncheats.me]_.7z?
I already downloaded and opened or extracted Xenos_2.3.2_[unknowncheats.me]_.7z — what should I do?
How do I remove Xenos_2.3.2_[unknowncheats.me]_.7z?
What kind of malware is Xenos_2.3.2_[unknowncheats.me]_.7z?
What is the SHA-256 hash of Xenos_2.3.2_[unknowncheats.me]_.7z?
How up to date is this analysis of Xenos_2.3.2_[unknowncheats.me]_.7z?
Community
Member reviews and reports for this exact file hash.