# Fake Game Downloads Deliver Amatera Stealer via Ren'Py Loader, MSBuild Abuse, and EtherHiding C2

> A malware-as-a-service campaign lures victims through fake game/software download sites and itch.io pages, trojanizing the Ren'Py visual novel engine to trigger a multi-stage MSBuild-abusing .NET loader chain (Nancy DLL -> GollopDevest -> PavinWide -> LanoseThrip) that deploys Amatera Stealer (or HijackLoader/Lumma Stealer). The campaign resolves its C2 domain via an Ethereum/BSC smart-contract lookup (EtherHiding), evading static-infrastructure takedowns.

- **Published:** 2026-07-20T00:00:00Z
- **Last reviewed:** 2026-07-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1569
- **ID:** TL-2026-1569
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 54 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Malwarebytes documented an active malware-as-a-service (MaaS) campaign in which threat actors distribute trojanized game/software installers through fraudulent download sites, itch.io pages, and file-sharing services (Wormhole, GoFile, Google Drive, MEGA). The lure archive contains a Setup.exe that launches a trojanized Ren'Py visual novel engine (the RenPy Loader / RenEngine Loader), which embeds malicious Python bootstrap code inside the legitimate libwin32.rpa Ren'Py package.

The RenPy Loader decrypts a Base64/XOR-encoded configuration file (key 81034149cd6f48c8821340204f92766e) and a second XOR-encrypted ZIP archive (key A50YyY1, filename j3lpTcg7kBRN.E3), performs sandbox-evasion checks via sys_config.is_sandboxed(), strips the Mark-of-the-Web alternate data stream (Zone.Identifier / ZoneId=0) to defeat SmartScreen, and injects random REM junk lines into an extracted BAT file (TP2hppNk5.bat) for obfuscation before execution via forfiles.exe.

The BAT script relaunches itself in a hidden conhost.exe --headless console, sets the environment variable MSBUILDENABLEALLPROPERTYFUNCTIONS=1, and abuses the legitimate, code-signed Microsoft build tool MSBuild.exe (Microsoft.NET\Framework\v4.0.30319\MSBuild.exe) to execute a malicious inline-task project, Nancy.csproj, alongside companion files Nancy.csproj.user, Internal.props, and Nancy.Compile.targets. These three files concatenate a hex-encoded DLL payload split across them, which MSBuild's inline C# task compiles and loads in-memory via AppDomain.CurrentDomain.Load / CreateInstance, invoking a class method named DefaultEvaluator5 — a textbook living-off-the-land binary (LOLBin) technique that evades disk-based AV signatures.

The resulting first-stage payload is a heavily obfuscated, trojanized clone of the legitimate open-source Nancy .NET web framework library. It implements a custom bytecode interpreter (Nancy.Runtime.mvlorimu resource, 23 custom opcodes) used to decrypt embedded strings via a multi-key XOR/S-box scheme (out[j] = data[j] XOR key1[j%b] XOR sbox[(j*m1+seed)&0xFF] XOR key2[...]), resolves Windows APIs by hash via GetDelegateForFunctionPointer, disables TLS certificate validation, manipulates the system proxy, and performs anti-forensic cleanup. It reads the _czzf environment variable (pointing back to Nancy.csproj) and decodes/executes the next stage: the GollopDevest downloader DLL.

GollopDevest implements the campaign's signature innovation, EtherHiding: rather than hardcoding a C2 domain, it issues an Ethereum JSON-RPC eth_call (method selector 0x06fdde03, the ERC-20 'name()'/string() function) against a Binance Smart Chain node (bsc-dataseed.binance.org) targeting smart contract 0x328a1fadff154290f0ce1389a4e633698cdfdaa7, decoding the returned string to obtain the live C2 address. This mirrors the EtherHiding technique publicly attributed to DPRK actor UNC5342 in Contagious Interview campaigns, giving the operators a censorship-resistant, cheaply-updatable C2 pointer (contract updates cost roughly $1.37 in gas per change in prior EtherHiding campaigns) that survives domain/IP takedowns.

GollopDevest downloads three further payloads from attacker infrastructure (paths /assets/ExponeAboard.json, /assets/MailersKogasin.json, /assets/LanoseThrip.json): PavinWide (an anti-analysis/anti-sandbox DLL), a second-stage GollopDevest loader DLL, and LanoseThrip (a C++ DLL wrapper) that decrypts and loads the final payload, Amatera Stealer, reaching out to C2 login.orbitalframework[.]cc.

Amatera Stealer is itself a rebrand of ACR (AcridRain) Stealer, a MaaS C++ information stealer whose source was sold in 2024; the current version targets roughly 65 browsers and 137 desktop cryptocurrency wallets, harvests credentials, session cookies, messaging-app credentials, local files, and browser-extension data, and (per parallel eSentire/Proofpoint reporting from mid-2026) has moved from AES-256-CBC to an ECDH (NIST P-256) + ChaCha20-Poly1305 scheme for C2 traffic protection to defeat network inspection. Malwarebytes also observed the same distribution chain alternately delivering HijackLoader or Lumma Stealer as final payloads, consistent with a MaaS affiliate model where the loader-for-hire chain is payload-agnostic. GollopDevest itself has been observed in unrelated campaigns including ClickFix-style fake-CAPTCHA lures, indicating it is a shared/rented loader component rather than bespoke to this campaign.

The overall chain — Ren'Py engine abuse for initial execution, MSBuild.exe LOLBin abuse for in-memory .NET payload compilation/execution, and EtherHiding for resilient C2 resolution — represents a novel combination of techniques aimed opportunistically at gamers, software-piracy seekers, and mod/cracked-software downloaders, ultimately targeting credentials and cryptocurrency wallets.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1189 Drive-by Compromise
- T1204.002 Malicious File
- T1059.003 Windows Command Shell
- T1059.006 Python
- T1106 Native API
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1112 Modify Registry
- T1685 Disable or Modify Tools
- T1218.014 MMC
- T1620 Reflective Code Loading
- T1564.004 NTFS File Attributes
- T1070.004 File Deletion
- T1497 Virtualization/Sandbox Evasion
- T1518.001 Security Software Discovery
- T1547 Boot or Logon Autostart Execution
- T1082 System Information Discovery
- T1105 Ingress Tool Transfer
- T1090 Proxy
- T1071.001 Web Protocols
- T1568 Dynamic Resolution
- T1132.001 Standard Encoding
- T1102 Web Service
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552.001 Credentials In Files
- T1041 Exfiltration Over C2 Channel

## Sources

- [Fake games spread stealers with RenPy loader, MSBuild, and EtherHiding](https://www.malwarebytes.com/blog/threat-intel/2026/07/fake-games-spread-stealers-with-renpy-loader-msbuild-and-etherhiding)
- [Amatera Stealer: Rebranded ACR Stealer With Improved Evasion, Sophistication](https://www.proofpoint.com/us/blog/threat-insight/amatera-stealer-rebranded-acr-stealer-improved-evasion-sophistication)
- [Amatera Stealer 4.0.2 Beta: What's New in This Variant](https://www.esentire.com/blog/amatera-stealer-4-0-2-beta-whats-new-in-this-variant)
- [SVG Phishing hits Ukraine with Amatera Stealer, PureMiner](https://www.fortinet.com/blog/threat-research/svg-phishing-hits-ukraine-with-amatera-stealer-pureminer)
- [Amatera (Malware Family) - Malpedia](https://malpedia.caad.fkie.fraunhofer.de/details/win.amatera)
- [Novel fake CAPTCHA chain delivering Amatera Stealer](https://blackpointcyber.com/blog/novel-fake-captcha-chain-delivering-amatera-stealer/)
- [North Korean hackers use EtherHiding to hide malware on the blockchain](https://www.bleepingcomputer.com/news/security/north-korean-hackers-use-etherhiding-to-hide-malware-on-the-blockchain/)
- [North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts](https://thehackernews.com/2025/10/north-korean-hackers-use-etherhiding-to.html)
- [The Unkillable C2: How Attackers Are Moving Command and Control to the Blockchain](https://www.endorlabs.com/learn/the-unkillable-c2-how-attackers-are-moving-command-and-control-to-the-blockchain)
- [Amatera Stealer Campaign Uses ClickFix to Deploy Malware, Bypassing EDR by Patching AMSI in Memory](https://securityonline.info/amatera-stealer-campaign-uses-clickfix-to-deploy-malware-bypassing-edr-by-patching-amsi-in-memory/)
- ["EtherHiding" — Hiding Web2 Malicious Code in Web3 Smart Contracts](https://guard.io/labs/etherhiding-hiding-web2-malicious-code-in-web3-smart-contracts)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1569