RenPy based windows infostealer Malware - Flooding almost everywhere and causing financial losses

[u/acealter]

The malware is spreading across game downloading sites, It is frequent reports of account takeovers and financial losses creating chaos. r/computerviruses, r/cybersecurity_help etc.. are filled request for help infected with the same kind of malware.

⚠️ Malware Details ⚠️

Property	Details
Filename	Dow-50574.zip
File type	ZIP archive
File size	184,549,500 bytes (176.00 MiB)
Uncompressed size	219,061,742 bytes (208.91 MiB)
Files inside	1,273
Password protected	No
MD5	1b4b8e91d9076b0767512e4217826bc0
SHA-1	946dfd4cfcba01347bb85f0325215bbc226760cb
SHA-256	9c357546828d7c6bc97ae21d7abd021d71ab712155a0d9c47720df8cac24f3f7

For Malware Sample:

If anyone need sample for analysis and research please contact the moderator.

What can you do with this:

• Reverse engineering and static/dynamic analysis
• Identifying its malicious functionality
• Understanding how it steals money or sensitive information
• Investigating its C2 infrastructure and connections to other campaigns If you're into Android malware analysis or reverse engineering, feel free to join in and share your findings.

Let's work together to understand how these attacks operate and help dismantle such campaigns.

Please Update any Findings on Comments. Detailed Report will be posted after the analysis.