RenEngine Loader — Pirated Game Installers Abuse Ren'Py Python Launchers + DLL Side-Loading to Deliver HijackLoader and Lumma/ACR/Vidar Stealers — Threadlinqs Intelligence
As of 2026-06-08, RenEngine Loader — Pirated Game Installers Abuse Ren'Py Python Launchers + DLL Side-Loading to Deliver HijackLoader and Lumma/ACR/Vidar Stealers is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 31 indicators of compromise.
Threat ID: TL-2026-0716 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
RenEngine is a Python-based loader distributed inside cracked game and software installers (visual novels, CorelDRAW) on piracy sites that redirect to MEGA. Malicious Ren'Py engine scripts display a
RenEngine is a novel multi-stage loader observed in active distribution since March 2025 and analyzed publicly by Kaspersky's Securelist in February 2026. It abuses the Ren'Py visual-novel game engine's embedded Python runtime to bootstrap an infostealer infection chain that masquerades as a legitimate game or software installation.
Distribution: Operators seed cracked/pirated game and software installers (visual novels, CorelDRAW repacks) across piracy and warez sites (hentakugames[.]com, dodi-repacks[.]site, artistapirata[.]fit, gamesleech[.]com, parapcc[.]com, saglamindir[.]vip, awdescargas[.]pro, filedownloads[.]store). Victims are redirected to MEGA file-sharing to download a ZIP archive (e.g. setup_game_8246.zip) containing a Ren'Py-style launcher.
Stage 1 — Ren'Py Python abuse: The launcher runs modified Ren'Py Python scripts (e.g. __init.py__) that first call an is_sandboxed() function to evade automated analysis, then use an xor_decrypt_file routine to XOR-decrypt an embedded ZIP archive, unpack it into a .temp directory, and launch the unpacked payload — all while a fake game loading/installation screen is shown to the user. Kaspersky detects this component as Trojan.Python.Agent.nb / HEUR:Trojan.Python.Agent.gen.
Stage 2 — DLL side-loading: The unpacked payload contains a legitimate, validly signed binary — Ahnenblatt4.exe (a German genealogy application), sometimes renamed (e.g. DKsyVGUJ.exe) — alongside attacker-supplied DLLs. The malicious cc32290mt.dll contains a patched code snippet that intercepts control when the signed application launches (DLL search-order hijacking / signed binary proxy execution). Companion DLLs borlndmm.dll (a benign Borland memory manager) and dbghelp.dll are present; dbghelp.dll is overwritten in memory with decrypted shellcode. Kaspersky detects this as Trojan.Win32.Penguish / Trojan.Win32.DllHijacker (HijackLoader).
Stage 3 — HijackLoader: cc32290mt.dll decrypts first-stage shellcode from a file named gayal.asp and injects it into dbghelp.dll. HijackLoader stores XOR-encrypted configuration in the %TEMP% directory under a random filename, writing that filename into a system environment variable for reactivation. It spawns cmd.exe in suspended mode via its modCreateProcess module, maps dbghelp.dll using ZwCreateSection / ZwMapViewOfSection, decrypts a second stage from hap.eml into pla.dll, and finally injects the stealer payload into explorer.exe. Modules observed include ti (main module), rshell (shellcode launcher), ESAL (final payload executor), and auxiliary modules modTask, modUAC, modWriteFile, and COPYLIST.
Anti-analysis / anti-forensics: The loader writes payloads using the Windows Transactional NTFS (TxF) API, deliberately writing the MZ header last and with a delay, then rolls back the transaction to delete the temporary file — defeating signature scanning of intermediate artifacts and hindering forensic recovery.
Stage 4 — Infostealers: The final payload is one of three commodity stealers — Lumma (Trojan-PSW.Win32.Lumma.gen), ACR Stealer (Trojan-PSW.Win32.ACRstealer.gen), or Vidar — which harvest browser credentials, cookies/sessions, crypto wallets, and other sensitive local data. Lumma uses dead-drop resolvers via Steam Community profiles (steamcommunity[.]com/profiles/76561199822375128) and rotating C2 domains. As of February 2026, ACR Stealer has become a primary payload. Top affected regions are Russia, Brazil, Türkiye, Spain, and Germany.
Weaknesses (CWE)
CWE-427, CWE-426
Target sectors: consumer, gaming, education
Target regions: Russia, Brazil, Türkiye, Spain, Germany
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 31 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1189, T1204.002, T1059.006, T1106, T1574.001, T1218, T1027, T1055, T1055.001