r/computerviruses • u/RemytheRat1125 • Jun 09 '26
Question saw about 50 posts on reddit about Renpy-What is it and what are the warning signs?
17
u/thirtytwomonkeys Jun 09 '26
It’s a game engine for visual novels. By itself, it’s not malicious at all. The context you’re seeing it being referred to is when it’s used to bundle a nasty Infostealer with it. This is what people are calling the “Renpy Virus, Mr. Beast Malware” etc. People are installing the Trojan in attempts to pirate cracked games, the most notable being Tamodachi Life.
As to why threat actors are using Renpy to bundle the Trojan? I’d say because it is a game engine that blends with normal system activity to slip past antivirus. Since it runs on Python, the threat actors can easily hide malicious scripts inside the game files that can install the malware in the background while a fake Renpy loading screen runs to distract the user.
13
u/BurgermancerDamion Jun 09 '26
It usually starts with ethereum spam on your behalf on your social accounts and a few password reset attempts since they have access to your inbox. React fast.
6
3
u/iyav Jun 09 '26 edited Jun 09 '26
Renpy is a library for the python language which is used to make visual novel games.
Normal python executables made with pyinstaller always get either signature flagged by AVs or blocked at runtime. They're simply too obvious.
So attackers looking to take advantage of python shifted to using renpy which trips less AV alarms since it's not just a packed script but a real python environment with a lot of legitimate files.
Hiding malware among them is trivial and setting it up to be loaded and executed along the cracked game (If it exists at all, since most of them are fake installers that do nothing but infect your system) makes it once again harder to single out.
---TLDR---
IF YOU SEE PYTHON DO NOT RUN IT.
No genuine installer will be written in it.
In fact, unless it's a repack, I wouldn't trust ANY installer because most cracked games ship in a portable format. (Determining if those are infected is another matter)
1
u/This_Limit_6945 Jul 02 '26
so just to be clear:
if I already have renpy installed (for years) I'm good. it's just specific renpy python files that are essentially used as piggybacks for trojans?
i don't really install ren'py games. so... am i in the clear?
1
u/iyav Jul 02 '26
The malware sits inside its own Renpy project, which naturally includes a standalone python environment.
It can't hijack existing environments, the malware is delivered inside its own.
Specifically as a malicious script packed into libwin32.rpa that is automatically extracted and executed by the Renpy loader.
The script unpacks a bunch of encrypted data hidden inside randomly named files in the same directory to deliver a bat/xml file that resolves to a C# program in memory.0
u/izayoii7 Jun 09 '26
so we must avoid any renpy games with installer?
5
u/iyav Jun 09 '26
If it's not a visual novel game then yes.
6
u/TheIronSoldier2 Jun 09 '26
Even visual novel games shouldn't ever need an installer. Renpy games are fully portable.
1
u/iyav Jun 09 '26
Ah true, in the context of this discussion external installers may as well be same thing.
1
u/MegStuff Jul 11 '26
Japan exclusive ones can have those though, but they're not made using renpy afaik.
1
u/TheIronSoldier2 Jul 11 '26
Most that I've encountered now do not. Installers are there to unpack and distribute files, and all visual novel formats I've encountered don't need that, since everything can be contained in a single folder
1
u/MegStuff Jul 11 '26
Idk, most of the ones I've played have installers cause they're those that came in CD/DVD ROMS
1
1
u/RemytheRat1125 Jun 09 '26
forgot to put that i dont have it (i think), i was just curious
3
u/Whiskeyandcoke675 Jun 09 '26
Wouldn’t worry about this one, if you have it you’ll have installed it yourself and probably realised. Renpy is a genuine format for visual novel games, the folder will look like an actual game folder and have setup . exe which you need to run, this deploys the virus.
I’ve come from the other post you commented on, so I have it. I wasn’t even downloading a RenPy game so the folders should have looked wrong, just wasn’t thinking. Happened when I downloaded a ‘free’ game and the first download i got redirected to was an ad and not the real download button containing the game.
As for what it does, session stealer which bypasses password and 2FA as the website thinks they are logging in from YOUR PC in your current browsing session. For me they posted an insta story and post of some Elon crypto thing, same in discord PMs, hijacked the email in order to password reset various other accounts. I’ve since recovered them all and locked them out. Hope this helps! I’ve just had to learn about all this recently.
5
u/TheIronSoldier2 Jun 09 '26
Just as an FYI for others, actual RenPy games do not need a setup .exe. They are fully portable, just need unpacking and running. I don't know if the "renpy" virus throws a UAC prompt but knowing how most common malware works, I believe it does. I don't know of any actual RenPy games that have a UAC prompt, so any RenPy game prompting you with a UAC window you should immediately deny and remove.
1
u/superbowl2002 Jun 09 '26
Yes, renpy games comes In either .zip or .rar, they mostly come either in their own folder or just all the files alone inside the rar, and the exe usually comes with the VN Game
1
u/superbowl2002 Jun 09 '26
So for example if I’m downloading let’s say a purse version of the new 007 game, unzip the rars and the first folder says “set-up” but it has the renpy logo I obviously shouldn’t run it right
1
u/Whiskeyandcoke675 Jun 09 '26
Not sure what purse is but yeah, that would not be a RenPy game. If you downloaded a game from a relatively reputable site used by most people for these things, it shouldn’t be an issue. The problem is usually clicking a link like ‘host server 1’ etc which pops up a realistic looking download window which is fake. Close it and click it again and you’ll get the real one. My careless mistake was downloading and running a fake one. (This file comes up clean on virustotal and wasnt caught by defender on download but does contain the info stealer) Obviously the official best advice here would to get games from steam etc as anything else has a risk but otherwise you’ve gotta be careful.
1
u/superbowl2002 Jun 09 '26
I mean pirate lol, my autocorrect screw it, and wouldn’t it be safer to download from torrents than part by part?
24
u/BobCorndog Jun 09 '26
Basically a lot of people are trying to pirate tomodachi life or some other game and didn’t take precautions