Loading malware…
RenPy Loader, also known as RenEngine Loader, is a Windows multi-stage malware loader that abuses the legitimate Ren’Py visual-novel engine to conceal malicious execution within counterfeit game, mod, software, and crack installers. Victims are typically presented with a plausible installation interface while embedded malicious code decrypts and extracts subsequent components. The loader has been distributed through fake download sites, malicious game-hosting pages, and file-sharing services.
RenPy Loader extracts script and MSBuild project components, uses legitimate Windows utilities and MSBuild to reconstruct and reflectively load an obfuscated trojanized .NET component, and employs staged decryption, API hashing, and in-memory loading. Observed variants perform sandbox checks, remove Mark-of-the-Web protections, and use EtherHiding to retrieve follow-on command-and-control infrastructure from blockchain-hosted data. It has delivered Amatera Stealer in documented campaigns, and has also been observed delivering HijackLoader and Lumma Stealer. The final payload may therefore vary by campaign. RenPy Loader targets Windows systems and is associated with malware distribution activity aimed at users seeking unauthorized or counterfeit software and game-related downloads.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
Run a full Windows malware scan. Scan the original archive, Downloads, Temp, AppData, startup locations, scheduled tasks, and browser-related data.
Contents of the BAT file: @echo off ... cmd.exe /c ...
If you opened the suspicious Setup.exe , saw a fake progress window, or noticed a brief Command Prompt window, treat the computer as potentially compromised... The .BAT suffix does not mean the entire infection is one batch file. It identifies one script-based stage inside a larger chain... The extracted material included a BAT file and MSBuild project files.
The suspicious pattern is MSBuild starting from a newly extracted game-installer directory, reading unexpected project files, loading code from a user-writable path, and then making network connections or spawning later stages. MITRE tracks this type of abuse as Trusted Developer Utilities Proxy Execution: MSBuild.
Déchiffre une archive ZIP (XOR + Base64) ... La DLL implémente un bytecode personnalisé avec 23 opcodes, déchiffrement multi-clés XOR
Resolves APIs using API hashing and GetDelegateForFunctionPointer.
The victim may see what appears to be a normal game or software installer while the malware runs silently in the background... By hiding malicious code inside software associated with gaming, attackers can make their downloads appear more believable.
The suspicious pattern is MSBuild starting from a newly extracted game-installer directory, reading unexpected project files, loading code from a user-writable path, and then making network connections or spawning later stages. MITRE tracks this type of abuse as Trusted Developer Utilities Proxy Execution: MSBuild.
Déchiffre une archive ZIP (XOR + Base64) contenant un fichier BAT et des fichiers projet MSBuild
Launches the payload using forfiles.exe... Executes MSBuild.exe with Nancy.csproj as its project file.
Effectue des vérifications anti-sandbox via sys_config.is_sandboxed()
Relaunches itself in a hidden or headless console: "C:\WINDOWS\System32\conhost.exe" --headless cmd.exe /c
30 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A loader mentioned only as part of a separate Amatera delivery campaign; no further behavior is described in this reference.
A malicious Ren’Py-based loader chain delivered via fake games, mods, cracks, or software installers. It uses script-based stages including BAT files, Python, MSBuild project files, and trojanized .NET components to unpack and execute later payloads, sometimes retrieving follow-on infrastructure before delivering stealers.
Loader initial qui abuse du moteur Ren’Py pour dissimuler du code malveillant, déchiffrer une archive ZIP, effectuer des vérifications anti-sandbox, supprimer le Mark of the Web, lancer le payload via forfiles.exe et transmettre des données de tracking avant d’amorcer la suite de l’infection.
A multi-stage loader distributed via fake game/software downloads. It abuses the legitimate Ren'Py engine, decrypts embedded archives and configs, extracts payloads to TEMP, removes Mark-of-the-Web, launches via forfiles/MSBuild, and ultimately delivers follow-on malware including stealers.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.