Loading malware…
RenPy Loader, also known as RenEngine Loader, is a multistage Windows malware loader that abuses the legitimate Ren’Py visual-novel engine to conceal and execute malicious Python code. It is distributed through fake games, mods, cracks, and software installers hosted on fraudulent download sites, malicious game-hosting pages, and file-sharing services. A decoy installation interface conceals background execution. Observed campaigns have delivered Amatera Stealer, Lumma Stealer, and HijackLoader, demonstrating that the final payload varies between operations.
The initial stage checks for sandbox environments, decrypts an embedded archive, and extracts batch scripts and MSBuild project components into a randomly named temporary directory. It removes Mark-of-the-Web restrictions and invokes the Windows forfiles utility to initiate subsequent execution. Batch-script stages abuse MSBuild to reconstruct and reflectively load a trojanized Nancy .NET library. The ensuing chain uses obfuscation, API hashing, encrypted components, and anti-analysis measures to conceal execution. In campaigns delivering Amatera, an intermediate downloader uses EtherHiding to retrieve encrypted command-and-control information from BNB Smart Chain data before downloading further components that decrypt and load the stealer. The initial loader also transmits the victim’s MAC address and a campaign identifier for infection tracking. Credential, session, wallet, and file theft are functions of delivered stealer payloads rather than established native capabilities of RenPy Loader.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
Des faux sites de téléchargement ... Des pages itch.io malveillantes
T1566.002 — Phishing: Spearphishing Link (Initial Access)
Run a full Windows malware scan. Scan the original archive, Downloads, Temp, AppData, startup locations, scheduled tasks, and browser-related data.
Contents of the BAT file: @echo off ... cmd.exe /c ...
If you opened the suspicious Setup.exe , saw a fake progress window, or noticed a brief Command Prompt window, treat the computer as potentially compromised... The .BAT suffix does not mean the entire infection is one batch file. It identifies one script-based stage inside a larger chain... The extracted material included a BAT file and MSBuild project files.
The suspicious pattern is MSBuild starting from a newly extracted game-installer directory, reading unexpected project files, loading code from a user-writable path, and then making network connections or spawning later stages. MITRE tracks this type of abuse as Trusted Developer Utilities Proxy Execution: MSBuild.
Les victimes téléchargent une archive contenant un fichier Setup.exe ... Une fausse interface d’installation est affichée pendant que le malware s’exécute en arrière-plan.
Run a full Windows malware scan. Scan the original archive, Downloads, Temp, AppData, startup locations, scheduled tasks, and browser-related data.
Run a full Windows malware scan. Scan the original archive, Downloads, Temp, AppData, startup locations, scheduled tasks, and browser-related data.
Déchiffre une archive ZIP (XOR + Base64) ... La DLL implémente un bytecode personnalisé avec 23 opcodes, déchiffrement multi-clés XOR
Resolves APIs using API hashing and GetDelegateForFunctionPointer.
The victim may see what appears to be a normal game or software installer while the malware runs silently in the background... By hiding malicious code inside software associated with gaming, attackers can make their downloads appear more believable.
Performs anti-forensics operations.
The suspicious pattern is MSBuild starting from a newly extracted game-installer directory, reading unexpected project files, loading code from a user-writable path, and then making network connections or spawning later stages. MITRE tracks this type of abuse as Trusted Developer Utilities Proxy Execution: MSBuild.
Déchiffre une archive ZIP (XOR + Base64) contenant un fichier BAT et des fichiers projet MSBuild
Launches the payload using forfiles.exe... Executes MSBuild.exe with Nancy.csproj as its project file.
Effectue des vérifications anti-sandbox via sys_config.is_sandboxed()
Relaunches itself in a hidden or headless console: "C:\WINDOWS\System32\conhost.exe" --headless cmd.exe /c
Extracts the ZIP contents to a random folder under %TEMP%... and writes a :Zone.Identifier alternate data stream (ADS) with ZoneId=0 to remove the Mark of the Web and bypass SmartScreen.
During project evaluation, a malicious MSBuild property function hex-decodes and reflectively loads the next DLL stage.
Supprime le Mark of the Web via un Alternate Data Stream (ADS) :Zone.Identifier avec ZoneId=0
Changes network settings, including disabling TLS certificate validation and setting the default system proxy. Performs anti-forensics operations.
Effectue des vérifications anti-sandbox via sys_config.is_sandboxed()
In the analyzed chain, code stored in data/libwin32.rpa decrypted an embedded ZIP and extracted it to a random directory resembling %TEMP%\tmp-12345-abcdefghijkl\ .
The documented campaign then used EtherHiding to obtain follow-on infrastructure through data stored on a public blockchain and ultimately delivered Amatera Stealer.
30 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.