rojo-rbx@1.4.3

Analysis

The install hook (scripts/install.js) is a Windows-only downloader and persistence implant. On install it fetches a remote VBS payload from hxxps://l81[.]me/updater[.]vbs (a URL shortener), writes it to %APPDATA%\Rojo\rojo-sync.vbs, registers a Run-key entry (HKCU\Software\Microsoft\Windows\CurrentVersion\Run, value name RojoClientSync) that executes the dropped script via wscript.exe, and launches it hidden and detached. The payload is fetched and executed at install time with no user interaction.