Loading malware…
RenPy Loader, also known as RenEngine Loader, is a Windows multi-stage malware loader that abuses the legitimate Ren’Py visual-novel engine to conceal execution within trojanized game and software packages. It has been distributed through fake games, mods, software installers, and cracked-software downloads hosted on fraudulent download sites, malicious game-distribution pages, and file-sharing services. Victims are typically shown a benign-looking installer or loading interface while the malicious chain runs in the background.
RenPy Loader decrypts embedded content, extracts batch-script and MSBuild project stages into a temporary location, and abuses MSBuild to reconstruct and reflectively load a trojanized .NET component. Observed implementations perform sandbox checks, remove Mark-of-the-Web protections, use legitimate Windows utilities for proxy execution, resolve APIs dynamically, and apply layered obfuscation and anti-analysis measures. Later stages have used EtherHiding to retrieve encrypted command-and-control information from blockchain-hosted data, complicating infrastructure identification and blocking.
RenPy Loader has delivered Amatera Stealer in documented campaigns. Other observed campaigns have used the loader to deliver HijackLoader or Lumma Stealer, so a RenPy Loader detection does not by itself establish the final payload. When Amatera is deployed, affected systems may be exposed to theft of browser credentials and session data, cryptocurrency-wallet data, messaging-application data, browser-extension data, and local files. The loader is therefore best treated as an initial execution and payload-delivery framework rather than a fixed single-payload infection.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
Run a full Windows malware scan. Scan the original archive, Downloads, Temp, AppData, startup locations, scheduled tasks, and browser-related data.
Contents of the BAT file: @echo off ... cmd.exe /c ...
If you opened the suspicious Setup.exe , saw a fake progress window, or noticed a brief Command Prompt window, treat the computer as potentially compromised... The .BAT suffix does not mean the entire infection is one batch file. It identifies one script-based stage inside a larger chain... The extracted material included a BAT file and MSBuild project files.
The suspicious pattern is MSBuild starting from a newly extracted game-installer directory, reading unexpected project files, loading code from a user-writable path, and then making network connections or spawning later stages. MITRE tracks this type of abuse as Trusted Developer Utilities Proxy Execution: MSBuild.
Déchiffre une archive ZIP (XOR + Base64) ... La DLL implémente un bytecode personnalisé avec 23 opcodes, déchiffrement multi-clés XOR
Resolves APIs using API hashing and GetDelegateForFunctionPointer.
The victim may see what appears to be a normal game or software installer while the malware runs silently in the background... By hiding malicious code inside software associated with gaming, attackers can make their downloads appear more believable.
The suspicious pattern is MSBuild starting from a newly extracted game-installer directory, reading unexpected project files, loading code from a user-writable path, and then making network connections or spawning later stages. MITRE tracks this type of abuse as Trusted Developer Utilities Proxy Execution: MSBuild.
Déchiffre une archive ZIP (XOR + Base64) contenant un fichier BAT et des fichiers projet MSBuild
Launches the payload using forfiles.exe... Executes MSBuild.exe with Nancy.csproj as its project file.
Effectue des vérifications anti-sandbox via sys_config.is_sandboxed()
Relaunches itself in a hidden or headless console: "C:\WINDOWS\System32\conhost.exe" --headless cmd.exe /c
30 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as a separately detected payload that may be associated with a fake game or mod download; the content explicitly cautions not to attribute it to CircuitryAg.exe based solely on an online comment.
A loader mentioned only as part of a separate Amatera delivery campaign.
A loader mentioned only as part of a separate Amatera delivery campaign; no further behavior is described in this reference.
A malicious Ren’Py-based loader chain delivered via fake games, mods, cracks, or software installers. It uses script-based stages including BAT files, Python, MSBuild project files, and trojanized .NET components to unpack and execute later payloads, sometimes retrieving follow-on infrastructure before delivering stealers.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.