Matrix Hub — full technical report (HackerOne accepted, duplicate exploit)

This report was submitted to Roblox via HackerOne and accepted as “excellent threat intelligence” (duplicate exploit). Since it’s a duplicate, the full report is now public to expose the cheat authors and help the community.

Sample under analysis:

Container: newuimatrixwithpatch_1781284925.zip — SHA-256 90daa26171b09a0a11fa7ced8296459e1ee4340f7a6e14812695a764d5c4714f
Origin: https://beta.mtxapi.shop/newuimatrixwithpatch_1781284925.zip (Mark-of-the-Web preserved)
Product: Matrix Hub (matrixhub.xyz, $5.50 lifetime, HWID-locked key system)
Distribution variants observed in the wild: the full post-login zip from beta.mtxapi.shop, and a smaller loader-only zip distributed via Discord (beta.mtxapi.shop/loader_<unix-ts>.zip) which fetches the heavy data.dat / version.dat at runtime.

TL;DR

Matrix Hub is a professionally engineered, commercial, paid, kernel-mode Roblox cheat. The attack chain is BYOVD with Intel iqvw64e.sys (CVE-2015-2291) manually mapped via kdmapper, gated by license validation against a Contabo VPS — a runtime backend deliberately split off from the Cloudflare-fronted customer dashboard. The operator distributes per-customer payload binaries from a public GitHub repository: the entire customer base’s version.dat builds are publicly listable and downloadable (~3 GB, 178 unique SHA-256s, 4 product tiers, new build every 2–5 days). The operator’s identity is self-leaked down to the Gmail address ([email protected]) in 139 public commits. The cheat itself is a cheat (no bundled stealer/RAT/miner across 10 cross-tier samples checked) but the operator’s only follow target and only stargazer is a renamed account (nomitaned ← Ilyaskand, account ID 150134733) that publicly hosts an active Discord IP-logger and a Defender-bypass + payload-execute chain whose dropped Windows32.exe files Windows Defender auto-quarantines on contact. The cheat does Authenticode signer-cert validation on injection targets (rejects renamed-binary honeypots), and Hyperion’s existing anti-VM check refuses to launch inside Hyper-V — so all active use is on bare-metal Windows 10/11. The Roblox-actionable yield: (a) network IOCs for client-side detection; (b) 178 file hashes for direct hash-blocklist; (c) a clear takedown chain (GitHub → Contabo → Cloudflare); (d) the full stage-by-stage kernel-bypass chain with the registry/IOCTL/handle artefacts that fire live.

The five highest-impact findings (in order of Roblox value)

0.1 Operator-controlled GitHub CDN

The operator distributes every customer’s version.dat as a separate file in a single public GitHub repository:

https://github.com/zonemunmun1-beep/ep1

178 cheat-payload binaries, total ~3.17 GB, named attachments-<8-zero><8-hex> (legacy Discord attachment-ID format; the operator has migrated from a Discord CDN to GitHub).
File sizes cluster into 4 buckets matching cheat product tiers (lite ~15.5 MB ×73, medium ~24.5 MB ×34, standard ~25–26 MB ×44, XL ~35 MB ×6).
Byte-exact verification: the analysed sample’s version.dat (SHA-256 b144ab151d78a904628a415e1e53983955d558cc625f3f9f173c5888f3dd519c) is byte-identical to attachments-00000000D2436C99 in the repository.
Each file’s SHA-256 is uniquely hashable, so Roblox can blocklist every known Matrix Hub build directly at the client.
Update cadence: a new build commits every 2–5 days. 141 commits at the time of writing, all titled update attachments <unix-timestamp>. A January 2026 cadence spike (26 commits in one month vs ~12/month average) tracks a product/UI revision the operator is currently shipping.
Two committer identities are visible in the metadata: leak (~109 commits) and nopparut (~32 commits), both signed with the same [email protected] email — same operator, two local git config aliases.

0.2 Runtime C2 backend (Contabo VPS, plain TCP, off-Cloudflare)

The cheat’s actual runtime license/version-check server is not mtxapi.shop or matrixhub.xyz (those are the customer-facing Cloudflare-fronted dashboard and zip CDN). The real C2 is direct-attached at a third-party VPS:

Field	Value
Host	`vmi2954509.contaboserver.net`
IP	`158.220.125.197`
Port	`9998` (custom, plain TCP, no TLS)
Provider	Contabo GmbH (AS51167)
Region	Lauterbourg, France (postal 67630)
Protocol	2-byte client send, 88-byte server reply, total ~350 ms
Encoding	Server reply is plain ASCII XOR’d with single-byte key `0x7A`
Decoded payload	A GitHub raw-content URL: `https://github.com/zonemunmun1-beep/ep1/raw/refs/heads/main/attachments-<hex>`

The endpoint is constructed at runtime in data.dat’s .vlizer virtualized section (no plaintext or XOR-encoded .rdata strings, no SNI to grep since the transport is plain TCP), which is why static IOC enumeration based on import tables or string sweeps will miss it.

Detection signal: any TCP connection from a gaming-client machine to 158.220.125.197:9998 is, with near 100% confidence, a Matrix Hub instance. The 2-byte 48 06 send followed within 1 s by an 88-byte reply that decodes (XOR 0x7A) to a github.com/zonemunmun1-beep/ep1/raw/ URL is an even more specific protocol fingerprint.

0.3 The operator identity is self-leaked in public commit metadata

Field	Value
Primary GitHub	`zonemunmun1-beep` (display name “Luv”, account ID 228934220, created 2025-08-27)
Self-leaked Gmail	`[email protected]` (in 139+ commits to `ep1`)
Commit author handles	`nopparut`, `leak`, “Luv”
Timezone in commit metadata	UTC+07:00 (Indochina Time; dashboard offers THB as first currency → Thailand)
Developer build path (PDB-style debug string in every payload binary)	`D:\AIMTX\KernelBhop\imgui-1.91.9-docking\imgui_demo.cpp`
Developer’s other inferred project name	`AIMTX\KernelBhop` (“Aim Matrix” / “Kernel Bunnyhop”) — strongly implies the developer maintains a separate kernel-mode bunnyhop cheat

0.4 The operator’s only follow target + only stargazer is an active malware host

The cheat dev follows two accounts. One (nopparut, id 39131651) is a dormant 2018-vintage zero-repo account. The other is publicly active:

Field	Value
GitHub	`nomitaned` (display name “e”, account ID 150134733, created 2023-11-07)
Previous username (same account)	`Ilyaskand` — confirmed via the noreply email format embedding the account ID: `[email protected]` and `[email protected]`
Status	Sole stargazer of `zonemunmun1-beep/ep1`; only-followed account by zonemunmun1-beep

nomitaned openly hosts:

nomitaned/api/main.py — a fork of DeKrypt’s Discord image-logger that exfiltrates the victim’s IP, geolocation, ISP, ASN, browser, OS, mobile status, and VPN status to a hardcoded Discord webhook https://discord.com/api/webhooks/1171185603862351922/_fFIC_BwBxRytfjkA6WD91HO9uSaS_5HRIK7ajUm0XFHjeZLmdMm1Kcn36Xkw5Ik1H2h whenever a victim opens a baited image.
nomitaned/e — a 4-file download-and-execute chain:
- exclusion: Add-MpPreference -ExclusionPath 'C:\\' (excludes the entire C:\ drive from Defender)
- tekst.ps1: three base64-EncodedCommand blocks adding per-path Defender exclusions for AppData\Roaming\Windows32.exe and friends, then Invoke-WebRequest of Windows32.exe from this repo, then Start-Process -Verb RunAs
- invoke: same downloader pointing at Ilyaskand/e (the old URL still resolves via GitHub’s redirect, preserving compatibility with hardcoded victim downloaders)
- start: silent launcher of the dropped Windows32.exe
- Commit history shows a recurring “upload Windows32.exe → delete Windows32.exe” cycle, 8+ rounds between 2025-03-22 and 2025-04-21
- 3 of 4 recovered Windows32.exe variants from pre-delete commit SHAs are auto-quarantined by Windows Defender real-time scan the moment they touch disk (Defender event IDs 1116 + 1117)
nomitaned/ep — a PyInstaller-bundled Python main.exe (8 MB, SHA-256 6FDD9EAFC248BA20FDA95241D9737699AA70614ADE183E4B7BF368A4E7D6C668) uploaded 2025-05-13T19:01:17Z and deleted 2 minutes later. Still recoverable from commit SHA 22d8bd7789175b9d062957125a478ee0bbf29395.
nomitaned/DigistumpArduinoDe and nomitaned/DigiKeyboardBe — forked Digispark / DigiKeyboard libraries with German + Belgian keyboard layout patches. Digispark is the standard BadUSB / Rubber Ducky HID keyboard injection device; localised layout patches are work you do to make auto-typed payloads land correctly on non-US keyboards.

0.5 Kernel-mode bypass chain — full execution observed live

In a license-bound + injection-target-present configuration, the cheat fires the entire kdmapper chain end-to-end. The cheat’s own console emits, in order, on a successful launch:

[Auth] Login Success
NtLoadDriver Status 0x0
Fixing stack cookie
DriverEntry returned 0x0
NtUnloadDriver Status 0x0
Success
Connect success
Finding roblox...

This is the dynamic confirmation of the BYOVD chain: NtLoadDriver returns 0, iqvw64e.sys DriverEntry returns 0, the operator’s user-mode shim “fixes the stack cookie” (their own console wording — patching the loaded driver’s GS cookie at runtime so the driver doesn’t crash on first call), then unloads the named driver to scrub the SCM record, and proceeds to use the in-memory kernel mapping for arbitrary-physical-memory primitives. The Connect success line is the cheat’s own DKOM/in-game pipe ready signal; Finding roblox... is the injection-target probe.

The chain is demand-gated: in a configuration without a valid _license.dat cache, or without an injection target process, the kernel artefacts never appear. The cheat will sit at the version-check stage indefinitely waiting on the missing precondition. This timing matters for Hyperion telemetry that runs only at game-process start: the high-fidelity kernel-side artefacts (\Device\Nal handle, IOCTL 0x80862007 traffic, iqvw64e.sys drop) appear during the active injection window, not during idle / menu / activation states.

Detection signals for Hyperion (ranked by fidelity)

#	Signal	Fidelity	Where to look
1	File with SHA-256 ∈ {set of 178 GitHub `attachments-*` blobs} present on user’s filesystem	100% (operator’s entire customer base)	Anti-cheat file scanner. Hash list buildable in one pass over the GitHub repo.
2	Outbound TCP to `158.220.125.197:9998` from a process whose binary hashes to any of the above	100% (no legitimate use of that IP:port combination on a gaming machine)	Hyperion network telemetry
3	2-byte `48 06` TCP send to ANY IP on port 9998, followed within 1 s by an 88-byte receive whose payload XOR’d with `0x7A` decodes to an ASCII URL beginning `https://github.com/zonemunmun1-beep/ep1/raw/`	100% (operator’s protocol signature)	Hyperion network telemetry
4	DNS resolution of `vmi2954509.contaboserver.net` or `*.contaboserver.net` from a process matching Matrix Hub timing	Very high	DNS client
5	Open handle to `\Device\Nal` from any process on a system also running Roblox	Very high (Intel NAL driver has no legitimate runtime use on a consumer gaming machine)	NtQuerySystemInformation SystemHandleInformation
6	DeviceIoControl `0x80862007` with one of the sub-function IDs `0x25 / 0x19 / 0x33 / 0x1A` (kdmapper signature)	Very high	Driver telemetry
7	Disappearance / overwrite of Hyperion’s own ntdll prologue trampolines mid-session	High (cheat’s user-mode hook restorer removes Hyperion hooks)	Hyperion self-integrity check
8	Disable-write to `HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config\VulnerableDriverBlocklistEnable` (value = `0`) followed within 30 s by an NtLoadDriver call	Very high	Registry + driver-load auditor
9	Disable-write to `HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\EnableVirtualizationBasedSecurity` on a system that previously had VBS enabled	High (security downgrade)	Registry policy auditor
10	CreateRemoteThread into `RobloxPlayerBeta.exe` from a non-ntdll RIP origin	High (Hyperion likely already monitors)	Process integrity
11	Non-Microsoft caller to `BaseFlushAppcompatCache` (undocumented kernel32 export)	High (no legitimate consumer use)	API monitor
12	Local `_license.dat` file at the working directory of an unsigned 27 KB console executable, containing exactly 48 ASCII bytes matching `[a-z0-9]{6}(-[a-z0-9]{6}){6}`	High	File-content sweep

The single highest-yield detection is signal #1 (hash blocklist of the 178 GitHub blobs). It catches the entire customer base at file-presence-time, doesn’t require runtime telemetry, and is trivial to maintain because the operator updates the same repo.

Operational takedown targets

GitHub repo zonemunmun1-beep/ep1 — GitHub abuse report. SHA-256 byte-match between Matrix Hub sample version.dat and the GitHub file attachments-00000000D2436C99. Single-purpose repo, 141+ commits all named update attachments <epoch>.

GitHub user zonemunmun1-beep — same form, request account suspension. Self-evident from the repo’s sole purpose.

GitHub user nomitaned (aliased from Ilyaskand) — same form. nomitaned/api is an active IP-logger; nomitaned/e is a Defender-bypass + payload-execute chain; Defender auto-quarantines binaries from this repo.

Contabo VPS vmi2954509 / 158.220.125.197 — abuse report to [email protected]. Plain-TCP custom-protocol C2 for a commercial Roblox cheat.

Cloudflare-fronted matrixhub.xyz, beta.mtxapi.shop — abuse report to [email protected]. Customer storefront / CDN. Cloudflare can sever the proxy relationship.

Google Drive ID 13tJLkveFFzSRjuuhYmXrIwLvVuvYC-Dq — Google Drive abuse report. Hosts the operator’s unsigned Bloxstrap fork.

Gmail [email protected] — Google abuse report. Self-disclosed in 139+ public commits to the cheat-payload repository.

Operator infrastructure map

CUSTOMER-FACING (Cloudflare)
  matrixhub.xyz      login, payment, dashboard
  beta.mtxapi.shop   CDN: zip + loader
      |
      v
  newui.exe --> data.dat (<7-hex>.dat)
      |
      v
RUNTIME C2 (Contabo, plain TCP)
  data.dat --> 158.220.125.197:9998
      |        Contabo GmbH, France
      |
      |  reply: 88 bytes XOR 0x7A
      |  = GitHub raw URL for this HWID
      v
PAYLOAD STORAGE (GitHub, public)
  github.com/zonemunmun1-beep/ep1
  178 binaries, ~3 GB, 4 tiers
  update cadence: every 2-5 days

FALLBACK LAUNCHER (Google Drive)
  MTX-Bloxstrap-Installer-2.9.0.exe
  unsigned .NET 6, 12.21 MB
  operator's Bloxstrap fork

Per-target IOC summary

File hashes

Primary commercial sample (full post-login zip):

container zip:           90daa26171b09a0a11fa7ced8296459e1ee4340f7a6e14812695a764d5c4714f
newui.exe loader:        86b734d08fc815c1f34d502b880a05e4c8a7af078eae63fab800ad34ec94c76b
data.dat orchestrator:   ccc76ed87050655bc66c9b1ba1d95b5e973305e55d902c2e0782d0c5e978ef38
version.dat encrypted:   b144ab151d78a904628a415e1e53983955d558cc625f3f9f173c5888f3dd519c
version.dat decrypted:   d07615d3bc7ae9bedc2506ae4a41eabe187d319e9ac35efa13181814fca2fc6b
iqvw64e.sys (carved):   4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b

Loader-only variant (smaller Discord-distributed zip, beta.mtxapi.shop/loader_<unix-ts>.zip, ~1.5 MB):

loader_1756390497.zip URL pattern
newui (newui-tree):      86B734D08FC815C1F34D502B880A05E4C8A7AF078EAE63FAB800AD34EC94C76B   (byte-identical to primary newui.exe)
loader-variant archive contains two UI subdirectories: newui/ and oldui/

MTX-Bloxstrap-Installer fallback:

MTX-Bloxstrap-Installer-2.9.0.exe:  154C73DB6962A6A9F6EDDDE50729880D1A01E86DF89871AB96F90609567E6281
  size: 12,505,332 bytes (12.21 MB on disk)
  signed: NO (unsigned binary)
  framework: .NET 6 desktop app
  upstream legitimate Bloxstrap.exe (v2.9.0):  12,790,592 bytes (signed by pizzaboxer)
  distribution: drive.usercontent.google.com/download?id=13tJLkveFFzSRjuuhYmXrIwLvVuvYC-Dq

10 cross-tier samples downloaded from GitHub for diff:

GitHub filename	Size (bytes)	SHA-256
`attachments-0000000000629702`	15,940,096	`047AEE76FDF92E917EBF678E9B48D1C52321BD4EAFEECDAD9435AE1735A67304`
`attachments-00000000FA91CFD5`	16,023,040	`5358F3AF460CEA6B012E6C41A958220F6AE338F1B74D5577E52C0D2F53DC4429`
`attachments-0000000008C8A13A`	24,370,176	`C21CFE0A6595E55B0017511863B8DDA54F8069C13593A2D16EA124B9CAC0ACA2`
`attachments-0000000067F999A6`	24,476,672	`22D84B46AACE3425AE541FDE1F94A186A85231E6E020FF50A0CC3D0C64D1AD66`
`attachments-000000001C6C8D85`	25,897,472	`F8C7A6D9DB5EB130307B9675B63AB7278A0B3AD878221F051E6A2136827313F2`
`attachments-00000000FE218301`	25,946,624	`FBA59F277ABE5B23C1E24C62EE803CA1940CBF6038A8536C6EACAAA974CB7893`
`attachments-000000001FC75B0A`	35,371,008	`97588A7C1CC4CCAB6DD97F489C111BE7012A295C76740B47DB301527F42A63D6`
`attachments-00000000DABDB5F0`	35,278,848	`10AEAC6563B9658B48E6E1D3AA37830EA7ED80C5BBC44E2076CCC6900EB95D4E`
`000000009E6512B6` (no prefix)	25,570,816	`3F9B2FDB7EADE6EAF48806A4C15A41318E6723FD648CC6AC47FA4016BAD7B13B`
`00000000FA2274FD` (no prefix)	15,689,728	`529B2BDC925171D881F95D947BEB1177ADDCD14D62CDB0D95F23D787CB10ECE6`

All 10 decrypt with the same XOR keystream to valid MZ PE headers and contain NalMmapAddressEx + iqvw64e strings (kdmapper signature confirmed in every one).

Operator-network artefact:

nomitaned/ep main.exe (deleted, recoverable):
  6FDD9EAFC248BA20FDA95241D9737699AA70614ADE183E4B7BF368A4E7D6C668

Network IOCs

Runtime C2:
  vmi2954509.contaboserver.net  (158.220.125.197)
  TCP/9998 (plain, not HTTPS)
  AS51167 Contabo GmbH, Lauterbourg, France (postal 67630)
  Protocol: 2-byte client send (constant 48 06), 88-byte server reply (ASCII XOR 0x7A)
  Reply decodes to: https://github.com/zonemunmun1-beep/ep1/raw/refs/heads/main/attachments-<8-hex>

Customer-facing infrastructure (Cloudflare):
  matrixhub.xyz, www.matrixhub.xyz, beta.mtxapi.shop
  Cloudflare ASN (172.67.x.x and 104.21.x.x ranges seen)
  beta.mtxapi.shop also serves loader_<unix-ts>.zip — the loader-only variant URL pattern

Fallback Roblox-launcher distribution:
  drive.usercontent.google.com/download?id=13tJLkveFFzSRjuuhYmXrIwLvVuvYC-Dq
  hosting: Google Drive (Drive abuse path applies)

Operator's other surface:
  github.com/zonemunmun1-beep             (cheat dev account)
  github.com/zonemunmun1-beep/ep1         (cheat-payload repo, 178 files, 141+ commits)
  github.com/nomitaned                    (operator's only follow / sole stargazer)
  github.com/nomitaned/api                (Discord IP-logger)
  github.com/nomitaned/e                  (Defender-bypass + payload-execute chain)
  github.com/nomitaned/ep                 (deleted PyInstaller binary, recoverable)
  github.com/Ilyaskand/e                  (alias of nomitaned/e, account renamed)
  https://github.com/zonemunmun1-beep/ep1/raw/refs/heads/main/attachments-*  (CDN URL pattern)
  https://discord.com/api/webhooks/1171185603862351922/_fFIC_BwBxRytfjkA6WD91HO9uSaS_5HRIK7ajUm0XFHjeZLmdMm1Kcn36Xkw5Ik1H2h
                                          (nomitaned's IP-logger exfil endpoint)

TLS certificate-transparency footprint:
  matrixhub.xyz   60 cert entries since 2021-12-16, ZeroSSL ECC + Google Trust + Let's Encrypt
  mtxapi.shop     12 cert entries since 2026-03-01, Sectigo Public + Let's Encrypt
                  (the mtxapi.shop domain is recent — 2026-Q1 introduction of the Contabo-decoupled CDN)

Filesystem indicators (cheat-writes)

<CWD>\<7-hex>.dat               renamed data.dat (per-host rename to defeat filename signatures)
<CWD>\<20-digit-decimal>        HWID file (filename == content == 20-byte ASCII decimal)
<CWD>\_license.dat              license cache: 48 ASCII bytes = the customer's purchased token verbatim
                                  format: [a-z0-9]{6}(-[a-z0-9]{6}){6}
                                  no header, no signature, no checksum, no obfuscation
                                  validation is server-side via the Contabo backend's HWID binding,
                                  not client-side via crypto over the file contents

Registry indicators (cheat-writes, demand-gated to kernel-escalation)

HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy\VerifiedAndReputablePolicyState                   = 0  (Smart App Control off)
HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\EnableVirtualizationBasedSecurity              = 0  (VBS off)
HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity\Enabled = 0  (HVCI off)
HKLM\SYSTEM\CurrentControlSet\Control\CI\Config\VulnerableDriverBlocklistEnable                  = 0  (block-list off)

These four writes are the smoking-gun precursor to the NtLoadDriver iqvw64e.sys call. Any process writing 0 to VulnerableDriverBlocklistEnable followed by an NtLoadDriver invocation within 30 s is, in 2026, almost certainly malicious.

Driver / device indicators

Device path:           \Device\Nal
Symbolic links:        \??\Nal, \DosDevices\Nal
IOCTL code:            0x80862007  (Intel device-type 0x8086 + FILE_ANY_ACCESS + METHOD_NEITHER)
IOCTL sub-functions:   0x25 (map / unmap), 0x19 (read), 0x33 (write), 0x1A (auxiliary unmap)
Carved driver SHA-256: 4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b

Process-behaviour signatures

Console subsystem; prompts on stdin:
  "Type 'yes' to accept the Terms of Service:"
  (Loader-variant only — on first run when newui downloads its data.dat / version.dat fresh:)
  "Matrix Login / Input License:"  ← stdin license-token prompt

First post-launch stdout line:        "Successfully loaded library"
Post-version-check stdout line:       "[loader] Matrix is up to date."

Successful-launch console transcript (license bound + injection target present):
  [Auth] Login Success
  NtLoadDriver Status 0x0
  Fixing stack cookie
  DriverEntry returned 0x0
  NtUnloadDriver Status 0x0
  Success
  Connect success
  Finding roblox...

Author convention in console output:  "[loader] ...", "[ui] ...", "[Auth] ..."

Embedded Roblox asset IDs (baked into every cheat instance)

Catalog-URL form:
  https://www.roblox.com/asset/?id=12215752379
  https://www.roblox.com/asset/?id=12215752426
  https://www.roblox.com/asset/?id=12290941253
  https://www.roblox.com/asset/?id=10384163683

rbxassetid:// form (9 unique IDs):
  rbxassetid://12939036056  (×2 references)
  rbxassetid://13422668599
  rbxassetid://13856404606
  rbxassetid://13856405303
  rbxassetid://15416061545
  rbxassetid://86433652951149
  rbxassetid://94451148966574
  rbxassetid://139827763749706

Roblox security/anti-abuse staff own the disposition of these. The mix of legacy 10-digit IDs (~2022) and recent 14-digit IDs (2025–2026) suggests durable UI/audio assets plus a rotating script-hub payload.

Architecture and stage breakdown

Three executable stages

The cheat has three stages, not four. No separate launcher-matrix.exe exists; the post-login download from matrixhub.xyz is the same zip whose contents drive the entire chain.

Stage 1 — newui.exe (27 KB, console subsystem, x64, unsigned)
            • TOS prompt on stdin
            • Calls LoadLibraryW on data.dat (renamed to <7-hex>.dat on first run)
            • Forwards stdout from data.dat's console output

Stage 2 — data.dat (1.4 MB DLL, VMProtect ".vlizer" section ~87% of file)
            • License-check function (virtualized in .vlizer)
            • TCP socket to 158.220.125.197:9998
            • HWID derivation (MachineGuid is read 6× during this stage)
            • Writes _license.dat on successful bind
            • Loads version.dat into memory, runs Stage 3 decryption keystream

Stage 3 — decrypted version.dat (25 MB PE, all kernel logic)
            • Embedded iqvw64e.sys driver bytes at file offset 0x6615D0
            • Dynamic API resolver (LdrLoadDll wininet/ws2_32/crypt32/bcrypt/mswsock/sspicli)
            • User-mode hook scanner / restorer
            • Direct-syscall stubs (NtAddAtom / NtGdiGetUFI / NtSetCompositionSurfaceStatistics donors)
            • Four registry-policy disables → NtLoadDriver → IOCTL traffic → process injection

Across the loader-only Discord variant the layout is the same but ships in two UI subdirectories (newui/ and oldui/), each with its own newui.exe/data.dat pair. Both newui.exe binaries are byte-identical to the primary sample (SHA-256 86b734d0…ec94c76b).

HWID and license model

HWID is a 20-digit decimal value (= a 64-bit unsigned integer; the observed 14862620081624380438 = 0xCE4E84F088F9A0D6).
Derivation runs inside the .vlizer virtualized section; HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid is read 6× during license check and is almost certainly an input.
The HWID is written to disk as a file whose filename equals its content — a 20-byte ASCII decimal string in the cheat’s working directory.
_license.dat is the cheat’s license-cache file. It is exactly 48 bytes of ASCII: the customer’s purchased token in [a-z0-9]{6}(-[a-z0-9]{6}){6} format, verbatim, with no header, no signature, no checksum, no obfuscation. License validation is entirely server-side: the Contabo backend binds the token to the HWID and gates the GitHub URL it serves on that binding. The client treats the file as a pure cache — its only check is “this token bound to my HWID at the backend, yes/no” via the runtime TCP handshake.
A token that has never been bound to a HWID at the dashboard side will pass the initial Contabo handshake but the cheat exits before kernel work; a token whose dashboard HWID matches the local HWID receives the full personalised attachments-<hex> URL and proceeds.

Injection-target validation

The cheat’s injection-target probe is not just name-and-path matching. A locally-staged honeypot at the canonical Roblox install paths using renamed copies of an unrelated Microsoft-signed binary was not treated as a valid target — the cheat sat in the version-check / Finding roblox... state without firing kdmapper, while CPU usage on its own process climbed steadily (the inner search loop was running) and the Intel NAL driver never loaded.

The cheat additionally rejects:

An unrenamed copy of a non-Roblox signed binary at the canonical path
A Roblox-signed binary (RobloxPlayerBeta.exe carved from an old install) at the canonical path with no surrounding Roblox companion files

The validation walks the Authenticode signer-cert chain on the target candidate (rejects anything not signed by Roblox Corporation) and checks the surrounding Roblox install layout (companion files, version manifest, content tree).

Hyperion anti-VM blocks Hyper-V deployment

Hyperion / Byfron’s existing anti-VM check refuses to launch Roblox inside Hyper-V. The check fires at Roblox process start and aborts with Virtual machine detected. As a consequence:

All real users of Matrix Hub run it on bare-metal Windows 10/11. Hyper-V deployment is not a customer-side path.
A defensive corollary: a guest running Hyperion is by Roblox’s own design not a real player. Any client-side detection that runs only on a non-VM host is sufficient.
The operator does not need to bundle their own anti-VM evasion because Hyperion’s anti-VM is the constraint, not the cheat’s.

Kernel-mode bypass chain — full technical detail

BYOVD with Intel iqvw64e.sys (CVE-2015-2291) — the headline finding

The decrypted core embeds the Intel-signed-but-vulnerable iqvw64e.sys driver byte-for-byte at file offset 0x6615D0:

Property	Value
SHA-256	`4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b`
Size	34,568 bytes
Machine	x64
Original Intel link timestamp	2013-11-14
Authenticode certificate	7,944 bytes, intact (Intel + VeriSign + Thawte chain)
Embedded PDB path	`c:\users\cloudbuild\337244\sdk\nal\src\winnt_wdm\driver\objfre_wnet_AMD64\amd64\iqvw64e.pdb`
Device path (runtime)	`\\Device\\Nal` (with symbolic links `\\??\\Nal` and `\\DosDevices\\Nal`)
CVE	CVE-2015-2291
Capabilities	Arbitrary physical memory map into user space via the `NalMmapAddressEx` IOCTL handler
Microsoft blocklist status	On the recommended driver blocklist for years

The cheat uses IOCTL 0x80862007 (the only IOCTL — the driver demultiplexes via a sub-function ID in the input buffer’s first qword):

Field	Value	Meaning
Device type	`0x8086`	Intel’s PCI vendor ID, literally embedded in the IOCTL — operator marker
Access	`0`	`FILE_ANY_ACCESS` — the bug; any opener hits privileged paths
Function code	`0x801` (2049)	`NalOsSpecificIoctl` dispatcher
Method	`0x7`	`METHOD_NEITHER` — raw user pointers, no kernel-side buffering

Four caller functions in the decrypted core, each sending IOCTL 0x80862007 with a different sub-function ID:

Caller (in decrypted core)	Sub-function ID	Input size	Operation
`FUN_180191900`	`0x25` (37)	32	Map / unmap physical memory
`FUN_180191fe0`	`0x19` (25)	48	Read primitive
`FUN_1801920b0`	`0x33` (51)	40	Write primitive
`FUN_180193210`	`0x1A` (26)	48	Auxiliary (likely `NalUnmapAddressEx`)

These match the public TheCruZ / z175 kdmapper source’s IntelDriver.cpp byte-for-byte — the cheat is using stock or near-stock kdmapper as the BYOVD wrapper.

Windows security-policy tampering (4 specific HKLM writes)

Before loading the driver, the executor disables four kernel-security policies. All four are HKEY_LOCAL_MACHINE writes requiring administrator (the cheat manifest declares requireAdministrator). The key / value names are XOR-encrypted in .rdata (key key[i] = 0x30 + i); recovered:

Wrapper function	Registry key	Value	Set to	Effect
`FUN_18021c2f0`	`SYSTEM\CurrentControlSet\Control\CI\Policy`	`VerifiedAndReputablePolicyState`	`0`	Disables Smart App Control reputation enforcement
`FUN_18021cc40`	`SYSTEM\CurrentControlSet\Control\DeviceGuard`	`EnableVirtualizationBasedSecurity`	`0`	Disables VBS (the foundation for HVCI)
`FUN_18021d5a0`	`SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity`	`Enabled`	`0`	Disables HVCI
`FUN_18021d860`	`SYSTEM\CurrentControlSet\Control\CI\Config`	`VulnerableDriverBlocklistEnable`	`0`	Disables Microsoft’s vulnerable-driver blocklist — the exact gate blocking `iqvw64e.sys` from loading

The single most damaging detection signal: any process that writes 0 to HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config\VulnerableDriverBlocklistEnable immediately followed by an NtLoadDriver call.

Direct-syscall construction via clean stub templates (Hyperion-hook bypass)

The dynamically-resolved API list (extracted by cracking the per-byte XOR key on the encrypted-strings table — key[i] = 0x30 + i mod 256) reveals three odd ntdll exports: NtAddAtom, NtGdiGetUFI, NtSetCompositionSurfaceStatistics. None are functionally needed by a Roblox executor. They are stub donors: their machine code is read from a clean copy of ntdll.dll and used as templates to build indirect-syscall thunks that bypass any user-mode hooks Hyperion has installed on ntdll’s system-service stubs.

The pattern (widely documented in offensive-tooling literature — HellsHall, HalosGate, TartarusGate, SysWhispers3):

LoadLibrary / GetModuleHandle on ntdll.dll
GetProcAddress(“NtAddAtom”) → raw bytes of a clean stub
Search the stub for mov eax, <SSN> opcode → recover the System Service Number
Allocate executable memory, copy a fresh stub there, replace SSN
Call your fresh stub instead of the (possibly-hooked) one in ntdll

By using stable, unhooked syscalls like NtAddAtom as the template, the cheat sidesteps Hyperion’s likely focus on the high-value injection syscalls (NtCreateThreadEx, NtMapViewOfSection, NtWriteVirtualMemory, NtProtectVirtualMemory).

User-mode hook scanner + restoration

Every API resolved by the cheat’s dynamic resolver is sanity-checked for the prologue pattern 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? FF E0 — that’s mov rax, imm64; jmp rax, the canonical 12-byte detour Hyperion (and most Microsoft Research-style API hookers) install at API prologues. If detected, the original bytes are restored from a clean ntdll copy before the API is called.

AppCompat shim cache spoofing via BaseFlushAppcompatCache

The string BaseFlushAppcompatCache is resolved from kernel32.dll. This is an undocumented kernel32 export that, with the AppCompat shim subsystem, lets callers flush and selectively re-populate the AppCompat shim cache. Companion error string [-] Error Can't Spoof\n confirms intent: the cheat is spoofing shim entries.

Service Control Manager bypass + driver-record scrubbing

NtLoadDriver is called directly (resolved via the dynamic API resolver), not through OpenSCManagerW + CreateServiceW + StartServiceW. This avoids any Service Control Manager event log entries.

After the manual map succeeds, the cheat calls NtUnloadDriver to scrub the SCM record. The console transcript NtLoadDriver Status 0x0 / Fixing stack cookie / DriverEntry returned 0x0 / NtUnloadDriver Status 0x0 shows the canonical kdmapper load-then-unload sequence.

PID-resolver function deliberately obfuscated (anti-disassembly)

The injection routine’s PID-resolver chain ends at FUN_181873030, which Ghidra fails to decompile cleanly:

WARNING: Control flow encountered bad instruction data
WARNING: Instruction at (ram,0x1818730c7) overlaps instruction at (ram,0x1818730c5)
WARNING: Removing unreachable block (ram, 0x18187309d)  (×8 more)
WARNING: Call to offcut address within same function
WARNING: Bad instruction - Truncating control flow here

The function uses overlapping instructions, an out (x86 I/O port) opcode whose decoded operand makes no sense, indirect calls to non-aligned addresses within its own body, and a hand-crafted LOCK-prefixed memory write the decompiler can’t reconcile. This is deliberately obfuscated code with anti-disassembly tricks (jump-into-mid-instruction). The operators went to this length only on the PID-resolver call — strongly suggesting this is where the Roblox process-name constant lives.

MTX-Bloxstrap-Installer — operator’s customised Roblox-launcher fork

The operator distributes a customised Bloxstrap fork (Bloxstrap is the popular open-source Roblox launcher by pizzaboxer). The operator recommends it as a fallback “if there is a Roblox version issue” — i.e. when a Roblox version-roll breaks the cheat’s injection target.

Property	Value
Filename	`MTX-Bloxstrap-Installer-2.9.0.exe`
Size	12,505,332 bytes (12.21 MB on disk)
SHA-256	`154C73DB6962A6A9F6EDDDE50729880D1A01E86DF89871AB96F90609567E6281`
Distribution	`drive.usercontent.google.com/download?id=13tJLkveFFzSRjuuhYmXrIwLvVuvYC-Dq`
Framework	.NET 6 desktop app
Signed	No (unsigned)
Upstream Bloxstrap.exe v2.9.0 (legitimate, signed by pizzaboxer)	12,790,592 bytes
Size delta	~285 KB smaller than upstream

The unsigned status is the headline operator marker: legitimate upstream Bloxstrap is Authenticode-signed; this fork is not.

Cross-tier sample scan — no bundled stealer / RAT / miner

Ten binaries sampled across all four tiers were downloaded from zonemunmun1-beep/ep1, decrypted with the XOR keystream, and string-scanned against strict patterns for Discord tokens, browser credential DBs, .ROBLOSECURITY, crypto wallets, Telegram tdata, webhook exfil URLs, XMRig flags, and RAT shellcode techniques.

Result: zero hits across all 10 samples on any strict stealer / RAT / miner pattern.

All 10 contain NalMmapAddressEx and iqvw64e strings → all 10 are confirmed Matrix Hub kdmapper-based cheat builds.

Developer build-path leak — present in all 10 samples:

D:\AIMTX\KernelBhop\imgui-1.91.9-docking\imgui_demo.cpp

That’s the developer’s own build machine — project name AIMTX\KernelBhop, ImGui 1.91.9 docking branch.

Methodology and compliance

Tools

Ghidra 12.1.2 headless decompiler + custom GhidraScripts
PowerShell + inline C# for PE parsing, XOR keystream recovery, entropy analysis
Hyper-V Gen-1 VM for dynamic verification
Sysinternals Procmon, Sysmon, Autoruns
Windows pktmon → Wireshark for protocol analysis
GitHub REST API (unauthenticated) for repo enumeration
crt.sh certificate-transparency search for domain footprint

Safety controls applied

Source zip never extracted via Explorer; entries read in-memory via System.IO.Compression.ZipFile.
Extracted executables defanged on write: .exe → .exe.bin, .dll → .dll.bin.
All extracted files marked read-only.
Zip-slip protection enforced.
No execution of any extracted file on the host. All execution was inside the Hyper-V VM.
VM network was air-gapped (Hyper-V Internal switch, no NAT, no host IP, no internet route) for the static-confirmation runs.
The activation run that produced the runtime-network IOCs briefly bridged the VM to External; the analyst explicitly accepted IP exposure.
VM state reverted to clean baseline after each detonation.
All artefacts kept in quarantine; no redistribution.
VirusTotal / Hybrid Analysis / Rolimon’s lookups were by hash only — no file upload.

The one-sentence Roblox handoff

Hyperion can blocklist the entire Matrix Hub customer base at file-presence-time today by hashing the 178 binaries in https://github.com/zonemunmun1-beep/ep1 and matching SHA-256 client-side; the runtime detection backstop is any TCP connect to 158.220.125.197:9998; secondary precursors are presence of the unsigned MTX-Bloxstrap-Installer-2.9.0.exe (SHA-256 154C73DB…7E6281) or a 48-byte ASCII _license.dat in a non-Roblox directory; the takedown chain is GitHub abuse → Contabo abuse → Cloudflare abuse → Google Drive abuse, and the operator’s public identity ([email protected], Thai-region, build path D:\AIMTX\KernelBhop\) is on file for anything else Roblox T&S wants to pursue.

— End of report —