SillyGoXLR Beyond the First Look — UAC Bypass, Persistence, Discord C2, and RAT Capabilities

Summary

SillyGoXLR is a fake GoXLR installer that delivers an obfuscated Java stealer and remote-access trojan. During an isolated execution, the sample copied its payload into a Windows-looking location, bypassed UAC, established logon persistence, retrieved remote configuration from GitHub, authenticated a Discord bot, collected browser and host data, captured the desktop, and successfully exfiltrated an archive.

The same payload registered commands for shell execution, process and service control, hidden VNC, SOCKS5 proxying, port forwarding, network scanning, keylogging, microphone capture, input blocking, file operations, self-update, and self-destruction.

This analysis distinguishes between behavior that was observed, behavior that was configured or attempted, and capabilities that were present but not invoked. This matters because a command or class name proves that functionality exists; it does not prove that an operator used it.

Credit and scope

This investigation starts where 0xRushy / RandomFlawsFinder’s original analysis stopped. That research identified the fake GoXLR lure, bundled Java runtime, Minesweep.jar, suspicious winver.exe and ComputerDefaults.exe activity, Discord communications, and audio/video capability.

We reproduced those central observations and extended the investigation into persistence, the complete UAC bypass sequence, remote-configuration fallback, successful Discord C2 and exfiltration, browser and host collection, the delayed cover application, and the registered RAT command surface.

The sample was executed on a disposable Windows 10 VM inside an isolated VLAN. Endpoint, filesystem, process-memory, network, and malware-log evidence were used to corroborate the behavior described below. Results apply to this sample and execution, not necessarily every SillyGoXLR build.

Samples

Minesweep.jar and FileExplorer.jar are byte-identical. The second filename is a persistent masquerade, not a separate payload.

Payload architecture

Static inspection identified a packaged Node.js launcher, a bundled Java 8 runtime, and an obfuscated Java payload. The JAR contained 15,076 classes, including 463 under dev.spark, and declared dev.spark.Main as its entry point.

Bundled libraries supported Discord/JDA communication, cryptography, native Windows access, HTTP, SQLite, webcam capture, audio processing, and Discord voice encryption.

Figure 1: End-to-end execution chain. Open the SVG for a full-size view.

The packed executable staged both the Java runtime and Minesweep.jar beneath %LOCALAPPDATA%\OutboundLauncher. The JAR then copied itself to:

%LOCALAPPDATA%\Microsoft\Windows\FileExplorer.jar

A new javaw.exe instance launched the copied payload as dev.spark.Main, separating the persistent stage from the original lure process.

Figure 2: Process events reconstruct the transition from the GoXLR lure to the persistent and elevated Java stages.

Execution timeline

All times are UTC on 14 August 2026.

UAC bypass: DebugObjectBypass(59)

The unprivileged Java process labeled the technique DebugObjectBypass(59). It requested that the AppInfo service start winver.exe with DEBUG_PROCESS, acquired the resulting debug-object handle, and terminated winver.exe while retaining the handle.

The malware then requested ComputerDefaults.exe, an auto-elevated Windows binary, through AppInfo. It applied the retained debug object to the new thread, received a CREATE_PROCESS_DEBUG_EVENT, duplicated the required handle with NtDuplicateObject, and caused ComputerDefaults.exe to launch the elevated Java stage.

Figure 3: Debug-object UAC bypass followed by scheduled-task persistence. Open the SVG for a full-size view.

The elevated process used this command structure:

"%LOCALAPPDATA%\OutboundLauncher\jdk8u482-b08-jre\bin\java.exe"
  -Dspark.elevated=true
  -Dspark.type=DEFAULT
  -cp "%LOCALAPPDATA%\Microsoft\Windows\FileExplorer.jar"
  dev.spark.Main

The process ancestry directly connected ComputerDefaults.exe to java.exe with spark.elevated=true.

Figure 4: The process tree corroborates the elevated Java lineage and the scheduled-task activity that followed.

Figure 5: ComputerDefaults.exe is the direct parent of the elevated process running FileExplorer.jar.

No malicious Run key or service was found, and the common ms-settings registry-hijack key was absent after execution. This build relied on the debug-object sequence for elevation and a scheduled task for persistence.

Persistence: ExplorerStartup

After elevation, the malware used schtasks.exe to delete any stale task named ExplorerStartup and create it again with the highest available run level.

Task:      \ExplorerStartup
Trigger:   Interactive logon
Run level: Highest available
Program:   %LOCALAPPDATA%\OutboundLauncher\jdk8u482-b08-jre\bin\javaw.exe
Arguments: -Xmx320m -XX:+UseG1GC
           -cp %LOCALAPPDATA%\Microsoft\Windows\FileExplorer.jar
           dev.spark.Main -no-startup

The task combined a Windows-looking name with a payload under %LOCALAPPDATA%\Microsoft\Windows, while the executable came from a user-writable bundled Java runtime.

Figure 6: The elevated Java process removes the stale task, recreates it for logon with the highest run level, and writes the task file.

Remote configuration and fallback

The elevated stage first requested configuration from the GitHub repository legend-drip-stone/ASFAchievementManager. The returned content could not be parsed, and the malware retried three times across two attempts before switching to legendary-drip-emerald/AnDE.

The fallback configuration succeeded and enabled Discord injection, MFA cancellation, and QR cancellation. It also supplied webhook material while disabling JAR auto-update for this run.

This fallback behavior allowed execution to continue even though the primary configuration source failed.

Discord C2 and exfiltration

The malware used JDA to authenticate a Discord bot and synchronize its commands. The operational log recorded the bot account Looking Everytime, one accessible guild, the target channel #trog, and 65 synchronized slash commands.

The bot login succeeded, a connected message was sent, and the collection archive was delivered to the selected channel. Memory also contained multiple webhook identifiers, showing that this build combined webhook functionality with an interactive bot-based command surface.

Figure 7: The elevated Java process resolves Discord C2, GitHub configuration, and public-IP/geolocation services.

Discord and GitHub use shared infrastructure. Their general domains and Cloudflare addresses should not be treated as malicious without the associated Java lineage, file paths, and persistence behavior.

Collection and exfiltration

Figure 8: Observed collection results and the route used to deliver them to Discord. Open the SVG for a full-size view.

Browser data

The malware terminated browsers, enumerated six user roots, and read browser databases directly from disk. Two Firefox profiles were found. One yielded 30 cookies and four autofill entries; neither contained saved passwords.

Chromium collection code was present, but the VM did not contain a Chromium profile. The environmental result therefore does not limit the capability of the payload.

Figure 9: Java accesses Firefox cookies, login, and form-history databases and writes WebCacheLock.json across enumerated profiles.

Discord sessions

Discord injection completed and token scanning ran for approximately 79 seconds. No victim token was recovered because the VM did not contain an active Discord profile.

Host discovery

The payload collected the host name, operating system, hardware identifier, public IP address, geolocation, and installed security products. It correctly identified Windows Defender and Elastic Endpoint and also checked for password managers and authenticator applications.

Social, gaming, wallet, and Telegram data

Collection routines covered Roblox, TikTok, Instagram, Steam, Minecraft, local cryptocurrency wallets, browser-extension wallets, and Telegram Desktop tdata. A Minecraft process watcher was started, but no session, wallet, or Telegram artifacts existed in the VM.

Files, screenshot, and archive

The interesting-file module scanned 210 files across six roots. It found no keyword matches and recorded three access denials. The pipeline still captured a 26,032-byte desktop screenshot, created a 10,598-byte ZIP, and successfully delivered the archive to Discord.

Outlook limitation

Outlook was not installed. No Outlook process, profile, PST/OST file, registry profile, or MAPI access was observed. Outlook theft is therefore not confirmed by this execution.

RAT command surface

The malware reported 65 synchronized slash commands. Memory analysis recovered 40 unique top-level command names. These commands prove that the operator interface existed, but they were not invoked during the observation window.

Command descriptions recovered from memory exposed process termination and suspension, service control, scheduled-task management, interactive and one-shot shells, reverse SOCKS5, port forwarding, internal-range scanning, hidden VNC, microphone recording, Discord voice-channel control, simulated typing, remote JAR updates, and cleanup/self-destruction.

Static strings also referenced clipboard monitoring, webcam capture, coercive text, and ransomware-like language. Clipboard capture, webcam capture, encryption, ransom-note creation, and destructive impact were not observed and remain capability-only findings.

Virtual-machine awareness

The malware assigned a virtualization score and detected three indicators in the analysis VM:

• VMware MAC prefix 00:0c:29
• Virtualization-related registry hardware
• vmmouse.sys

It set its internal VM flag to true but continued through persistence, C2, collection, and exfiltration. In this execution, the checks provided environment awareness rather than effective sandbox evasion.

Delayed legitimate application

While the theft pipeline was running, a background installer waited before downloading the legitimate GoXLR utility. It wrote the application to:

%LOCALAPPDATA%\GoXLR\GoXLR-Utility.exe

The legitimate 45,713,738-byte program had SHA-256 0a8743d27ea5d1741956aecfc3ae26c0f7399945cf29d2bb6b3dab459e86ac2f and launched at 11:25:14 UTC—almost five minutes after the archive had already been exfiltrated.

This delayed cover behavior could convince a victim that the installer was merely slow while the malicious activity had already completed.

MITRE ATT&CK mapping

Indicators of compromise

The Discord, GitHub, IPify, IPWhoIs, and Cloudflare domains and addresses observed during execution are shared infrastructure. They should be correlated with the process and file indicators above instead of blocklisted as standalone IOCs.

Conclusion

The first public analysis established that the fake GoXLR application delivered a Java stealer/RAT using Discord. This execution reveals the broader operational chain.

SillyGoXLR established logon persistence, completed a debug-object UAC bypass, survived failure of its primary configuration source, authenticated interactive Discord C2, collected browser and host data, captured the desktop, exfiltrated an archive, and finally launched a legitimate GoXLR program as cover.

Its registered command surface extends well beyond information theft into surveillance, shell access, host control, tunneling, hidden VNC, lifecycle management, and internal-network reach. The sample is therefore better understood as a full remote-access platform with autonomous stealing behavior than as a simple credential stealer.

References

• Another Morning, Another RAT Kiddie: SillyGoXLR — 0xRushy / RandomFlawsFinder

Analysis by Mohammed Alzahrani.