A Rhadamanthys infostealer campaign was distributed via malicious Ren’Py game bundles hosted on MediaFire, where a launcher and crafted Ren’Py scripts load a malicious package that ultimately injects Rhadamanthys into a .NET process. The campaign leverages Ren’Py’s python-packages import mechanism, uses encoded .key configuration files and decompressed helper executables to run the loader, and has resulted in multiple detections and observable IOCs. #Rhadamanthys #RenPy
Keypoints
- Threat actors distributed malicious Ren’Py game archives (ZIP named “Free Download Files.zip”) via MediaFire to lure users into executing a forged game installer.
- The installer (lnstaIer.exe) loads a legitimate Python script that decompiles archive.rpa to extract and execute a malicious script.rpy which imports a malicious python-package module.
- The malicious __init__.py module collects environment and system information, decodes a BASE64 .key JSON configuration, and extracts and runs a decompressed helper executable (example: UIS4tq7P.exe) from a created .tmp folder.
- UIS4tq7P.exe loads iviewers.dll and spawns a .NET child process into which Rhadamanthys is injected, while a fake game loading screen distracts the user.
- Attackers abused Ren’Py’s supported “python-packages” import behavior to ensure the malicious package is automatically imported when script.rpy runs.
- Other malware strains (e.g., LummaC2 Infostealer) have been distributed through compromised developer accounts in similar forums, indicating a broader threat to game-sharing communities.
- Multiple AV detections and several MD5 hashes and malicious URLs have been observed for this campaign, enabling detection and hunt efforts.
MITRE Techniques
- [T1204] User Execution – Malicious ZIP distributed via MediaFire (“Free Download Files.zip”) persuades users to run lnstaIer.exe as if installing a game. Quote: ‘When a user executes the legitimate executable file “lnstaIer.exe”, this file internally loads the legitimate script “lnstaIer.py”…’
- [T1036] Masquerading – Malicious content disguised as a legitimate Ren’Py game and legitimate executables (lnstaIer.exe, UIS4tq7P.exe) to appear benign. Quote: ‘This attack disguises itself as a normal game file, but when executed, a malicious loader is activated…’
- [T1129] Shared Modules – Abuse of Ren’Py “python-packages” import mechanism to automatically import malicious __init__.py from datapython-packagesplanner. Quote: ‘the “__init__.py” file in the “datapython-packagesplanner” path is imported automatically…’
- [T1218] Signed Binary Proxy Execution (or Living-off-the-Land) – Use of legitimate helper executable (OLEViewer-like UIS4tq7P.exe) to load iviewers.dll and host injected Rhadamanthys in a spawned .NET process. Quote: ‘When the “UIS4tq7P.exe” file is executed, it loads the “iviewers.dll” file located in the same path and then creates a .NET process as a child process. Afterward, the Rhadamanthys malware is injected into this process.’
- [T1560] Archive Collected Data (and Decompression) – The attacker stores malicious scripts inside archive.rpa and uses decompression to extract script.rpy and other payloads into a .tmp folder. Quote: ‘a folder named “.tmp” is created, and the compressed file is decompressed.’
- [T1112] Modify Registry (Environment Discovery/Sandbox Evasion) – Scripts check VM-related process and registry information via file_system.py and sandbox.py to detect virtualized or analysis environments. Quote: ‘file_system.py Script to check VM-related process and registry information (Linked to sandbox.py)’
- [T1046] Network Service Discovery / [T1016] System Network Configuration Discovery – internet_access.py used to check external internet connection as part of environment checks prior to payload execution. Quote: ‘internet_access.py Script for checking external internet connection’
- [T1140] Deobfuscate/Decode Files or Information – The .key configuration file is BASE64 decoded and decrypted to obtain execution parameters (file names, passwords). Quote: ‘the “.key” file is found and decoded in BASE64. The file is then decrypted to extract the file name, password, and file name to be executed…’
Indicators of Compromise
- [File Hash ] malware samples observed – MD5: 0026aee93b911e3e8588724e30f0816c, 01ff1b158afbe84c8f7fd4fce19d748b (and 3 more hashes)
- [File Name ] artifacts and helper executables – lnstaIer.exe (launcher), UIS4tq7P.exe (decompressed helper/OLEViewer), iviewers.dll (loaded DLL)
- [Archive Name ] distribution archive – “Free Download Files.zip” used on MediaFire to distribute malicious Ren’Py game package
- [Domain/URL ] command or download endpoints associated with campaign – https[:]//146[.]103[.]114[.]25/gateway/bi24namg[.]diqdh, https[:]//api[.]blagomezbart[.]top/gateway/j2ucqiol[.]ccile (and 3 more URLs)
- [File Type ] configuration container – .key (BASE64-encoded JSON configuration holding filenames and passwords)
Read more: https://asec.ahnlab.com/en/90767/