Is Xeno Executor Safe? Salat Stealer Risk and Cleanup

Xeno Executor is not safe to judge by its name alone. Splunk Threat Research confirmed that one password-protected Xeno package from xenoexecutor[.]in installed the utility while also dropping Salat Stealer. A different Xeno Executor.exe hash analyzed by Gridinsoft showed no detection. That does not cancel the malicious finding; it proves the source, archive, and SHA-256 hash matter more than the filename.

If you ran a Xeno package that asked you to disable Microsoft Defender, add an exclusion, or use an archive password, disconnect the PC from sensitive accounts, remove the package, restore protection settings, scan for dropped files and persistence, and revoke important sessions from a clean device.

What Splunk found in the Xeno bundle

In its July 2026 Salat Stealer investigation, Splunk analyzed a password-protected XENO.rar downloaded from xenoexecutor[.]in. Running the self-extracting Xeno.exe created two important branches: soa.exe installed the legitimate Xeno utility, while wios.exe contained the Salat Stealer payload [1].

This is why a working interface is not proof of safety. A trojanized installer can launch the program the user expected and execute a stealer in the background. Splunk associated SHA-256 fec793499d9df0458b611a71dda23b41ba1c28038a79924ab606937e26e77115 with the observed XENO.rar bundle and documented separate hashes for the installed component and Salat payload.

Why one Xeno file can scan clean and another can be malicious

You can inspect the specific clean Xeno Executor.exe report, but compare its complete SHA-256 with your file. Do not use a matching name or similar size as a shortcut.

Xeno warning signs that are not normal false positives

Code injection can trigger antivirus warnings, so a detection label alone sometimes needs review. The surrounding behavior is what separates a possible GameHack/PUA alert from a likely compromise. Stop and treat the PC as unsafe when you see any of these:

• the download comes from a mirror, ad redirect, Discord attachment, YouTube description, or password-protected archive;
• the page tells you to turn off real-time protection, restore every detection, or exclude an entire Downloads or executor folder;
• running Xeno.exe creates unexpected files such as wios.exe or launches hidden PowerShell, command-shell, or script activity;
• a path such as %APPDATA%\Microsoft\Windows\DefenderUpdates\docconv.exe appears without a legitimate software owner;
• Defender exclusions, firewall rules, scheduled tasks, startup entries, or security settings change without a clear prompt;
• Roblox, Discord, Steam, email, browser, or wallet sessions show logins or activity you did not initiate.

Roblox itself warns that cheating and exploit downloads can be used to distribute keyloggers or other malware and says exploiting violates its rules [2]. A website calling itself “official” does not remove either the device risk or the account-ban risk.

What to do if you ran Xeno.exe

1. Disconnect the affected PC from sensitive activity. Close the executor and Roblox, disconnect networking if suspicious processes are still running, and do not open email, banking, wallets, or password managers on that PC.
2. Preserve the useful identifiers. Record the download URL, archive name, archive hash if available, Defender detection name, and paths for files such as wios.exe, soa.exe, or docconv.exe. Do not upload the archive to forums or share it with other users.
3. Remove the downloaded package. Delete the original archive and extracted Xeno folder. Empty the Recycle Bin only after saving the non-sensitive identifiers you need for comparison.
4. Review Windows Security exclusions. Open Windows Security → Virus & threat protection → Manage settings → Exclusions. Remove unknown entries that point to the executor, Downloads, Temp, AppData, Startup, or a fake DefenderUpdates folder. Leave legitimate organization-managed exclusions alone.
5. Check persistence. Review Startup Apps, Task Scheduler, and recently installed applications for items created around the time you ran Xeno. The PowExcScr Defender exclusion guide shows the deeper checks when an alert mentions PowerShell or Add-MpPreference.
6. Run layered scans. Update Defender, run a full scan, and use Microsoft Defender Offline if alerts return after reboot. Microsoft notes that recurring malware may be reinstalled by a hidden component and recommends an Offline scan for that case [3].
7. Scan for leftovers before trusting the PC. A visible file may be gone while a loader, scheduled task, firewall rule, Defender exclusion, or bundled module remains. Run Gridinsoft Anti-Malware to check detections, hidden files, startup entries, scheduled tasks, unwanted apps, browser changes, and persistence.

Secure accounts after the device is clean

If the suspicious package ran, treat credentials and sessions used on that Windows profile as potentially exposed. Clean or isolate the PC first, then use a different trusted device for recovery.

Use the broader infostealer recovery checklist after a game or mod download for the full session and password order. If Roblox only reports an incompatible-software path and there are no malware signs, compare that path with the Roblox anti-cheat error guide before deleting drivers or normal security software.

How to tell whether cleanup worked

• Defender and Gridinsoft scans finish without detecting the original payload or new related files;
• removed exclusions, firewall rules, scheduled tasks, and startup items do not return after reboot;
• wios.exe, unknown docconv.exe, and the suspicious Xeno archive no longer exist;
• Windows Security real-time protection and SmartScreen stay enabled;
• no new account logins, password-reset messages, wallet approvals, or unsolicited Discord/Roblox activity appear after session revocation.

If detections or exclusions return, do not keep repeating the same in-Windows cleanup. Use Defender Offline, scan from a trusted environment, or reinstall Windows from clean media when persistent compromise cannot be removed reliably.

FAQ

References

1. Splunk Threat Research Team and Teoderick Contreras. “Bundled to Steal: The Salat Stealer Campaign.” Splunk, July 6, 2026. https://www.splunk.com/en_us/blog/security/bundled-to-steal-salat-stealer-campaign.html.
2. Roblox Support. “Cheating and Exploiting.” Roblox, accessed July 13, 2026. https://en.help.roblox.com/hc/en-us/articles/203312450-Cheating-and-Exploiting.
3. Microsoft Support. “Troubleshoot problems with detecting and removing malware.” Microsoft, accessed July 13, 2026. https://support.microsoft.com/en-US/defender/troubleshoot-problems-with-detecting-and-removing-malware.