Fake Games Distribute Amatera Stealer via RenPy Loader and Blockchain C2
Malware campaigns are leveraging fake game downloads, disguised with the RenPy engine, to distribute the Amatera Stealer, employing MSBuild and a novel blockchain-based C2 technique for evasion.
Cybercriminals are increasingly using deceptive tactics to distribute malware, with recent campaigns observed distributing the Amatera Stealer through fake game downloads. These malicious packages are often disguised using RenPy Loader, a tool that exploits the legitimate Ren'Py engine, commonly used for creating visual novels and interactive fiction. By embedding malicious code within software associated with gaming, attackers aim to increase the believability of their downloads and bypass user suspicion.
The infection chain begins when unsuspecting users download what they believe to be a game, mod, or software crack from various sources, including fake download websites, compromised itch.io pages, and file-sharing services like Google Drive and MEGA. After downloading an archive, users are prompted with a seemingly normal installation or loading screen, while the malware operates silently in the background. This multi-stage process is designed to be stealthy, making it difficult for users to detect the malicious activity until it's too late.
Once initiated, the RenPy Loader orchestrates a complex infection chain that abuses Microsoft Build Engine (MSBuild) and employs a technique known as EtherHiding. MSBuild, a legitimate development tool, is co-opted to execute malicious code, while EtherHiding is used to conceal the command-and-control (C2) server addresses. Instead of embedding the C2 information directly within the malware, attackers store it on a public blockchain. The malware then retrieves this information from the blockchain to locate its C2 server, a method that significantly complicates efforts to disrupt the attackers' infrastructure.
Amatera Stealer, the ultimate payload in these campaigns, is a potent information-stealing malware. It is designed to exfiltrate sensitive data from infected devices, including browser passwords, cryptocurrency wallet details, session cookies, messaging app data, and local files. The stolen credentials and data can grant attackers access to users' online accounts, leading to further compromise and financial loss. The malware's ability to target a wide range of sensitive information makes it a significant threat to individual users and organizations.
This campaign highlights a growing trend of attackers misusing legitimate software development tools and frameworks to distribute malware. Similar to previous instances involving Bun and Deno, the abuse of Ren'Py demonstrates how threat actors can leverage familiar technologies to disguise their malicious operations. This approach not only makes the initial distribution more convincing but also complicates the technical analysis and defense against such threats.
Furthermore, the RenPy Loader has been observed delivering other types of malware, such as HijackLoader and Lumma Stealer, indicating its versatility as a malware delivery mechanism. The specific payload can vary depending on the campaign, suggesting a modular approach by the threat actors involved.
To mitigate the risk of falling victim to such attacks, users are advised to download software exclusively from official sources and trusted platforms. Extreme caution should be exercised with cracked software, unofficial mods, and free versions of paid applications. Users should also be wary of download links that redirect through multiple unfamiliar websites and always inspect the contents of downloaded archives before executing any files. Employing reputable anti-malware software and keeping all systems updated are crucial layers of defense against these evolving threats.
The use of blockchain for C2 infrastructure represents a sophisticated evasion technique, making it harder for security researchers and law enforcement to track and dismantle the malicious operations. This innovative approach underscores the adaptive nature of cybercriminals and the continuous need for advanced threat detection and response capabilities.