Devilish Business

stolen game, and a modded with virus confirmed:
original game is by Bawdy Baron, March 2023.

The file is confirmed identical to the archived original, unsigned, and reports version 1.0.3.0. The deeper scan is reading its PE sections and large appended data area; this is the important distinction between a legitimate single-file Ren’Py bundle and an unrelated packed loader.

This is not a normal native Ren’Py launcher. It is a small unsigned .NET GameLauncher wrapper whose single embedded resource is about 250.66 MB; the entire PE body has near-maximum entropy and a deliberately nonsensical 2103 build timestamp. Those traits readily explain a generic heuristic detection. I’m now disassembling only the wrapper’s managed metadata/IL to see what it writes, launches, or checks—without invoking its entry point.

The wrapper contains unequivocally hostile launcher behavior: on first launch it checks for VMs, checks timing to detect analysis/sandboxes, requires 4.1 GB RAM, silently imports game\gui.reg with elevated regedit, decrypts game\cache\pyanalysis.xml using hard-coded AES keys, and pipes the plaintext into hidden noninteractive PowerShell. Only afterward does it start the legitimate Ren’Py launcher. I’m statically decrypting that script in memory now; I will inspect it but not execute or save it as a runnable script.

Confirmed: this is malware, not a harmless false positive. The registry file disables AMSI and adds broad Microsoft Defender exclusions; the decrypted PowerShell contacts attacker infrastructure, downloads a Python payload, establishes logon persistence as a fake Microsoft Edge update task, runs a downloaded .pyc, and reflectively loads another downloaded .NET payload. It also exits on Russian-language systems, a common criminal-malware safeguard. I’m performing read-only checks for its exact persistence files, registry markers, exclusions, and scheduled-task names to confirm whether it was ever activated.

Ran commands

Confirmed: DevilishBusiness.exe is a malicious launcher. Avast’s detection is valid, not merely a generic false positive.

Static analysis showed that it:

• Silently imports game\gui.reg with administrator privileges.
• Disables AMSI.
• Creates broad Defender exclusions for executables, PowerShell, Python, rundll32, msiexec, and other targets.
• Detects VMware, VirtualBox, Hyper-V, QEMU, Xen, KVM, and other analysis environments.
• Performs timing checks intended to detect sandboxes.
• AES-decrypts game\cache\pyanalysis.xml.
• Sends the decrypted code into hidden powershell.exe.
• Contacts miclookmx.com.
• Downloads payloads from 63.nl151.seedit4.me.
• Installs Python under: C:\ProgramData\Windows App Certification Kit\Python
• Downloads and executes a .pyc payload.
• Creates a fake MicrosoftEdgeUpdateTaskMachineCore... scheduled task.
• Reflectively loads another downloaded .NET payload directly into memory.
• Exits on Russian-language Windows installations.

The legitimate Ren’Py game is embedded alongside this malware and launched afterward, presumably as camouflage.

Relevant hashes:

• Malicious launcher: 44395F60EEC7F7F28E8EE093C63633007CDFA496E7E84A9D8DD9CEA9CD0F7945
• Encrypted PowerShell payload: A82418FBC0C89A36C6E70000335A37A54A9C7746D4C6E5383EA4E550815D202F
• Defender-disabling registry file: 3FB24C1CF71F0389D75AC8FB7AA7D48F304FE630FD5CC5FD228B611D7607A630