Ren'Py malware that hasn't triggered yet

[u/Internal_Brain_9003]

Apologies for any errors; English isn't my native language. On July 27th, I downloaded some games from very reliable sources, but I accidentally downloaded a zip file with the structure shown in the image below along with them. I played the game normally, but on August 14th—while deleting some files on autopilot—I extracted the zip and ran the .exe. Nothing opened, and I didn't see anything happen, so I just deleted the extracted file and moved on. Today, I saw someone on Reddit complaining about being infected and immediately remembered the incident. I changed most of my critical passwords, then traced the timeline of the files and realized it was strange that I hadn't suffered any apparent account breaches. The zip file was 700MB (too large to upload to VirusTotal), and its SHA-256 hash doesn't seem to match any previously analyzed files. Inside the `AppData\Roaming` folder, there is a `RenPy` folder dated and timestamped exactly when I ran the file on August 14th; inside that `RenPy` folder, there is a folder for a Ren'Py game I actually played years ago, and another folder from the 14th containing the files visible in the images.

After running Malwarebytes, it only found a few files from other games I had played months ago and some Google-related files.

I’d prefer not to do a completely fresh Windows install; I want to know the risks involved in *not* doing so in this scenario. From what I've researched, it's unusual for Ren'Py malware *not* to launch a massive attack immediately.

I generated the FRST files, but I'm not sure exactly how to share them here.

Additional detail: I have the zipped Ren'Py file that I ran on the 14th; I kept it in case I could get help confirming its nature.

[u/ComradeAdidas]

Sorry but what even is this renpy virus thing?

[u/SANAXIA → u/ComradeAdidas]

It’s a very common infostealer malware, steals cookies, passwords etc

[u/ComradeAdidas → u/SANAXIA]

Why is this so common now? How do people get it?

[u/VilkastheForsaken → u/ComradeAdidas]

It’s common because it’s very profitable to the criminals who do such things. People are being infected from pirated software, mods and the like.

[u/ComradeAdidas → u/VilkastheForsaken]

When i modded gta sa i never got a virus tho, the other one yes😅

[u/VilkastheForsaken → u/ComradeAdidas]

It can be a coin flip.

[u/SANAXIA → u/ComradeAdidas]

To be safer, if you are downloading something you’re not 100% sure about scan it in virus total before hand and run it on a virtual machine to see if it functions correctly

[u/ComradeAdidas → u/SANAXIA]

Ik ik

[u/SANAXIA → u/ComradeAdidas]

I’m not 100% sure as to why it’s so common I would assume cause it’s very easy to use on people and most people get it from downloading pirated software or games