Table 1: RenEngine Loader top 10 countries of users reached

Attack Overview 

Figure 3: Attack overview

Technical Analysis

Initial access occurs when users download pirated game installers from platforms that distribute cracks and game modifications, as shown in Figure 4. These installers are advertised as preactivated or cracked versions of commercial games. Users often trust these files to bypass licensing controls or avoid paying for legitimate software.

In addition to full installers, users frequently download game mods to customize or enhance gameplay. These mods are treated as low risk by users and are often executed without verification.

The Howler Cell Threat Research Team identified a popular game mod and crack distribution site delivering information stealer malware through both installers and mod packages.

The AAA game titles observed so far include:

• • Far Cry
  • Need for Speed
  • FIFA
  • Assassin’s Creed

This delivery method relies on social trust within piracy communities rather than technical exploitation. That makes it effective against users with limited security awareness and minimal endpoint protections.

Figure 4: Pirated game page displayed on the website

Clicking on the download link of the game we landed on a page go[.]zovo[.]ink as shown in Figure 5.

Figure 5: Zovo webpage showing button as "Download Setup"

Further clicking on Download Setup button of this page, it redirects us to the MediaFire download page containing the zip of pirated setup (which contains RenEngine Loader),) , the complete initial payload drop chain is shown in Figure 6.

Figure 6: Initial payload drop chain

RenEngine Loader

Once we download the zip & extract it with WinRAR or 7zip tool. The structure of files and directories will look as shown in Figure 7. Instaler.exe is a legitimate game launcher based on Ren'py visual novel engine and is abused here to execute a malicious python script.

Figure 7: Files and directories dropped by zip

The threat actors behind this campaign abused Ren’Py’s archive build feature to package the final payloads within an RPA file. Since common extractors like 7-Zip typically fail to unpack these archives by default, the compiled scripts remain embedded, likely as a tactic to evade static detection by security solutions and ensure the script is present only in memory.

Figure 8: Build options specified in options.rpy

As illustrated in Figure 8, the threat actors leveraged Ren’Py’s built-in archive functionality to consolidate all files into archive.rpa. Notably, they also deliberately removed all plain text script files (rpy) from the final build package leaving only the compiled scripts (rpyc).

On execution, Instaler.exe (Ren'py Launcher) by default decompresses archive.rpa present within game, launcher, or data directory and executes a compiled python script named script.rpyc. As visualized in Figure 9, We decompressed the RPA archive and decompiled the malicious python script for detailed analysis. This script has been designated by Howler Cell as RenEngine Loader.

Figure 9: RenEngine Loader: Decompiled Script.rpyc

RenEngine Loader reads a .key file from disk, decodes its contents using Base64 to retrieve JSON configuration details (see Figure 10). Based on this configuration, it locates an XOR-encoded archive, decrypts it using the specified key, and executes the process defined in the configuration from within the extracted archive. In addition to this staged delivery mechanism, the loader also implements extensive sandbox checks (detailed later in this blog) to evade analysis and ensure execution only on real user environments.

Figure 10: RenEngine Loader configuration

The configuration is structured as JSON and supports up to six identifiers, each serving a specific role during different phases of RenEngine Loader’s execution. The details of these fields and their respective functions are outlined in Table 2. 

Sandbox Check

Based on the decoded configuration, if the sandbox field is set to False, the RenEngine Loader initiates a sandbox check. The loader calculates a scoring sum based on different information it collects from the system, and the sum is compared at the end to identify if the current execution is within a sandbox machine.

Figure 11: Sandbox check simulated in a VMware guest

After completing all discovery actions (Figure 11), the calculated sum is converted into percentage. If this percentage is below 50, the loader proceeds with execution; otherwise, it terminates silently. Table 3 details the artifacts and comparisons used to determine whether the host is a virtual machine.

Table 3: List of sandbox checks performed to determine VM

Hijack Loader

Following the sandbox check, the RenEngine Loader retrieves a file named Zt5qwYUCFL.txt from disk and applies XOR decoding with the key eAX7G6bTT to obtain a ZIP archive. It then extracts the archive’s contents and executes a binary called W8CPbGQI.exe, continuing the malicious attack chain. The structure is shown in Figure 12.

Figure 12: Files present within the extracted archive

W8CPbGQI.exe is a legitimate signed executable which is abused to sideload and execute the malicious module d3dx9_43.dll. On Load, this module is responsible for dynamically loading another DLL from current directory named VSDebugScriptAgent170.dll using LoadLibraryA API (see Figure 13 for Snippet) and transfers execution to this DLL via indirect jmp instruction.

Figure 13: Module load using LoadLibraryA

VSDebugScriptAgent170.dll leverages the modified DllGetClassObject export function to perform dynamic API resolution, as illustrated in Figure 14.

Figure 14: Dynamic API resolution using modified DllGetClassObject.

Following dynamic API resolving, it performs module stomping on evr.dll; It is loaded via LoadLibraryA API and then execution is transferred using call EDX instruction, as shown in Figure 15.

Figure 15: Transfer execution to stomped EVR.DLL

Stomped Evr.dll reads an encrypted file named Froodjurain.wkk from disk, which serves as the configuration container for HijackLoader. This file holds compressed module data that is later unpacked by the malware using the RtlDecompressBuffer API with the LZNT1 compression format.

As shown in Figure 16, the malware looks for the magic value C6 A5 79 EA, followed by a 4-byte XOR key (DB CD 7B C6). This XOR key differs across samples. The configuration structure is outlined below:

IDAT: 49 44 41 54
Magic Number: C6 A5 79 EA
XOR Key: DB CD 7B C6

Figure 16: Encrypted IDAT Config

Figure 17: Illustrates how HijackLoader decompresses the data using the RtlDecompressBuffer API.

After decompression, the second-stage loader data appear as shown in Figure 18.

Figure 18: Decompressed data of second stage loader.  

The decompressed data contains a list of 38 modules. Early HijackLoader samples included only a small number of modules, mainly responsible for reading the configuration file, decrypting data, and loading the next stage.

Over time, the malware authors have expanded this set by adding many more modules to the existing framework. In the sample analyzed during this research, HijackLoader loads 38 separate modules (listed under Table 4), indicating its evolution from a simple loader into a highly modular framework.

Table 4: Modules Loaded by HijackLoader

In the next stage, the malware searches for the ti module (CRC = 0x3EE477F1) by comparing hardcoded CRC values against each available module. Once the matching module is identified, it loads a system DLL to inject the shellcode.

In our case, the target system DLL is predefined in the configuration (as shown in Figure 19) and is rasapi32.dll, which is loaded dynamically at runtime using the LoadLibraryW API.

Figure 19: Dynamically Loading rsaapi32.dll.

The malware creates a directory named broker_crypt_v4_i386 under %ProgramData%, which is also defined in the configuration. After creating this directory, it loads the COPYLIST (CRC= 0x1AE7700A) module and copies d3dx9_43.dll, Froodjurain.wkk, Taig.gr, and VSDebugScriptAgent170.dll as shown in Figure 20 to later establish persistence on the system dropping LNK on Desktop.

Figure 20: Dependent files in %ProgramData%\broker_crypt_v4_i386

The malware also creates a directory named %AppData%\Roaming\broker_crypt_v4_i386 using the CreateDirectoryW API and drops chime.exe into this location, as shown in Figure 21. It then sets the current working directory to %AppData%\Roaming\broker_crypt_v4_i386 and spawns a new process. During this process execution, two .tmp files are created in the %Temp% directory, which contain the configuration data and the shellcode for the final payload.

Figure 21: Dropped chime.exe in %AppData%\roaming\broker_crypt_v4_i386.

 In the final phase, the malware creates an executable named ZoneInd.exe under %AppData%\Local. The loader then implements process doppelgänging, writing the shellcode extracted from the .tmp files into both ZoneInd.exe and chime.exe.

Final payload - ACR stealer

Analysis of the final payload confirms it to be an ACR stealer, and its configuration is provided in Table 5, It is designed to harvest sensitive user data such as saved browser passwords, cookies, cryptocurrency wallets, and autofill information, along with system details and clipboard contents. This capability enables account takeover, session hijacking, and financial theft by quietly exfiltrating the collected data to its command-and-control (C2) server.

Table 5: Final ACR Stealer Configuration

In this campaign, only ACR stealer was delivered as final payload; however, in other similar scenarios, we observed different payloads such as Rhadamanthys stealer, Async RAT, and XWorm delivered via RenEngine Loader. The complete network infrastructure is shown in Figure 22. 

Figure 22: Complete network infrastructure

Conclusion

RenEngine Loader marks a significant evolution in loader-based attack chains. Unlike traditional loaders, RenEngine leverages the legitimate Ren’Py visual novel engine to embed malicious scripts within legitimate game launchers, exploiting the engine’s archive packaging feature to evade static detection. This approach demonstrates a creative abuse of gaming frameworks for malware delivery, making RenEngine a novel and stealthy initial-stage loader.

RenEngine’s capabilities extend beyond simple payload delivery. It incorporates: 

• Dynamic configuration decoding via Base64 and XOR encryption.
• Advanced sandbox scoring mechanisms to ensure execution only on real user environments.
• Telemetry integration for infection tracking, enabling campaign operators to monitor victim distribution globally.

Its role as the first stage in a dual-loader chain (preceding HijackLoader) highlights a growing trend toward modular, multi-layered attack architectures. By combining RenEngine’s stealth and HijackLoader’s extensive module set, threat actors achieve persistence, privilege escalation, and flexible payload deployment.

This discovery underscores the need for behavioural detection strategies focused on:

• Abuse of legitimate frameworks (e.g., Ren’Py).
• Unusual archive formats and embedded Python scripts.
• Sandbox evasion logic and staged decryption routines.
  
  

Appendix 

IOC’s

• SHA256: 9e3b296339e25b1bae1f9d028a17f030dcf2ab25ad46221b37731ea4fdfde057
• Zip Package: 9e3b296339e25b1bae1f9d028a17f030dcf2ab25ad46221b37731ea4fdfde057
• RenPy Installer (legitimate but exploited):
  • Instaler.exe: 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
• HijackLoader:
  • d3dx9_43.dll: 326ec5aeeafc4c31c234146dc604a849f20f1445e2f973466682cb33889b4e4c
• VSDebugScriptAgent170.dll:  db4ccd0e8f03c6d282726bfb4ee9aa15aa41e7a5edcb49e13fbd0001452cdfa2
• hxxps[://]dodi-repacks[.]site (Piracy game download website)

C2’s

• 78[.]40[.]193[.]126

MITRE

Initial Access:
• T1204.002 – User Execution: Malicious File

Execution:
• T1059.006 – Command and Scripting Interpreter: Python

Defense Evasion:
• T1027 – Obfuscated/Compressed Files & Information
• T1497.001 – Virtualization/Sandbox Evasion
• T1140 – Deobfuscate/Decode Files or Information
• T1055 – Process Injection
• T1055.013 – Process Doppelgänging

Persistence:
• T1053.005 – Scheduled Task/Job: Scheduled Task
• T1574.002 – Hijack Execution Flow: DLL Side-Loading

Privilege Escalation / Defense Evasion:
• T1548.002 – Bypass User Account Control

Discovery:
• T1082 – System Information Discovery
• T1012 – Query Registry
• T1057 – Process Discovery

Credential Access:
• T1555.003 – Credentials from Web Browsers

Collection:
• T1115 – Clipboard Data
• T1539 – Exfiltrate Web Session Cookies

Command and Control:
• T1071.001 – Application Layer Protocol: Web Protocols

Exfiltration:
• T1041 – Exfiltration Over C2 Channel

Back to Top