Malware Analysis - RenPy game, finding malware code in 2956 files, Beginner friendly
Many applications have thousands of files, making even non-obfuscated malware sometimes challenging. This malware is based on the visual novel engine framework Renpy. I show monitoring, strategies for finding malware code, decompiling Renpy code, extracting the remote access tool configuration, binary refinery decryption and unpacking the native payload with x64dbg. Discord: / discord Malware analysis courses: https://malwareanalysis-for-hedgehogs... Sample: https://bazaar.abuse.ch/sample/3c086e... Renpy unpacker: https://github.com/struppigel/hedgeho... Unrpyc: https://github.com/CensoredUsername/u... EvilConwi config extractor: https://github.com/struppigel/hedgeho... Buy me a coffee: https://ko-fi.com/struppigel Follow me on Twitter: / struppigel 00:00 Intro 00:40 Reddit post and video 03:03 Quick malware verdict with sandbox dump 06:03 ProcMon monitoring 10:04 Find sandbox checker with findstr 13:00 Entry points of execution environment 18:06 Decrypt the first layer with binref 21:00 Remote access tool loader 23:00 Extract config from abused ScreenConnect 27:33 Extract and decompiling renpy loader 31:53 Defeat anti-sandbox 32:56 Unpack the payload #malware #malwareanalysis #reverseengineering
How To Build Your Malware Analysis Lab In 2026
Analyze Malware Without Running It (Beginner Malware Analysis)
99% of Developers Don't Get WebSockets
Dynamic Malware Analysis: Tools & Workflow (Amadey Malware)
The Dark Web EXPOSED (FREE + Open-Source Tool)
AI Malware Analysis: Types of Malware
reverse engineering doesn't have to be hard
How to Remove All Viruses from Windows 10/11 (2025) | Tron Script
Build your own AI Malware Analysis Lab with Remnux
Malware Analysis - Deobfuscating NodeJs pkg packed stealer MythJs
How to Extract Shellcode Using x64dbg (Malware Analysis)
ROP is DEAD! Kernel Driver Binary Exploitation
The Malware that hacked Linus Tech Tips
Malware Analysis with Binary Ninja Plugins (API Hashing)
Malware Evasion Techniques: API Unhooking (Malware Analysis & Reverse Engineering)
This Video Can Exploit Your iPhone (CVE-2025-31200 #1)
An Introduction to Binary Ninja for Malware Analysis
Intro to Firmware Analysis with QEMU and Ghidra
IDA Free Reverse Engineering - Step-by-Step EXE Analysis
