Malware Analysis: Trojanized “Projekt Passion” Game Installer

A Telegram-Based Discord Token Stealer Hidden in a Ren’Py Game

1. Summary

A victim was contacted on Discord with a shortened (TinyURL) link advertising a “beta test” build of the anime game Projekt: Passion. The link led to a fake file-hosting page serving a ZIP archive. The archive is a genuine Ren’Py game used as a decoy, with one malicious file added: Setup[.]exe. That binary is best characterized as a trojanized launcher — it runs the real game so nothing looks wrong, while injected stealer code harvests the victim’s Discord token and exfiltrates it to a Telegram bot.

User’s avatar & username has been hidden per victim’s request (NDA)

The stolen token was then used to take over the account and mass-DM a crypto-casino scam (the soakwin[.]com family) to the victim’s contacts.

Any.Run hash report of the binary

2. Delivery Chain

Discord DM ("beta test this game")
   -> TinyURL short link (expired at time of analysis)
      -> Fake F95-style page: "Projekt: Passion" + DOWNLOAD HERE
         -> Fake "DriveFiles" host: file620594.storage11x[.]cfd  (mimics Google Drive UI)
            -> ZIP: Projekt_Passion_[S3_V0.17]_[Classy_Lemon]_Archive_latest_7254.zip
               -> Setup[.]exe (malicious) + a full legitimate Ren'Py game (setup[.]py, data\, renpy\, lib\)

• The lure impersonates a real Ren’Py visual novel (Projekt: Passion by Classy Lemon) to target F95zone / Discord game communities.
• The “DriveFiles” page is a spoof: fake “Malware Scanned / Secure Transfer / Fast Download” badges, generic stock background, throwaway .cfd TLD.

GoogleDrive UI impersonation

Extracted archive from URL file620594[.]storage11x[.]cfd

3. The Malicious File

The only malicious component is the Setup[.]exe PE:

• Delivered name: Setup[.]exe (102 KB)
• Canonical name (ANY[.]RUN): lnstaIer[.]exe — a typosquat of “Installer[.]exe” using a capital I in place of l
• Type: PE32+ executable (GUI) x86–64

Hashes:

SHA256  7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
SHA1    56dc080f728d7a276495d6a4371670f9ea71519b
MD5     0323998e0e85eca5fd90d9f8ecbbd6c2

VirusTotal — the community comments hxxps[://]www[.]virustotal[.]com/gui/file/7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab/detection

4. Decoy vs Payload (the key forensic step)

Everything in the archive except Setup[.]exe is legitimate Ren’Py engine code. Mislabeling any of it as malware is an easy trap.

Benign (the decoy game):

`setup[.]py` - the standard Ren'Py bootstrap launcher (`renpy[.]py`). It contains the stock distributor functions `path_to_gamedir`, `path_to_common`, `path_to_saves`, `path_to_renpy_base`, `path_to_logdir`, `predefined_searchpath`. This is the file that resolves where the game and its saves live - it is not a stealer.
`lib\python3.9\` (`contextlib[.]pyc`, `tokenize[.]pyc`, `token[.]pyc`, `requests`, `urllib3`, ...) - the game's own Ren'Py Python runtime. Reads of these in Procmon are the decoy loading, not a payload.
`renpy\` (`script[.]pyc`, `screenlang[.]pyc`, ...) and `data\` - the game scripts and assets.
`%AppData%\Roaming\RenPy\tokens\security_keys.txt` - a Ren'Py save-signing file (`renpy/savetoken[.]py`). It holds a per-install ECDSA key (`signing-key` / `verifying-key` / `signature` lines) to validate save files. 
`log[.]txt` (written in the game folder) - Ren'Py's normal game log.

setup.py partial code

Malicious:

`Setup[.]exe` (hash above) - flagged by VirusTotal and ANY[.]RUN as a stealer with Telegram C2. The artifacts below show it also references the bundled game files, which is why it presents as a trojanized launcher: it runs the genuine game as a decoy while the injected stealer executes.

The malicious binary “setup.exe”

5. Host Forensics

Browser history (Brave / SQLite): largely wiped. The victim had cleared history and site data, so the short-link destination could not be recovered from the local History database. The malicious URL was instead re-discovered through threat hunting.

No available URL’s within the extracted history of Brave Browser

Windows Prefetch: SETUP.EXE-A493DF79.pf, parsed in WinPrefetchView, confirmed execution of Setup.exe from the victim’s Downloads and listed the (mostly legitimate) game files it referenced while running:

\...\PROJEKT PASSION\SETUP[.]EXE
\...\PROJEKT PASSION\SETUP[.]PY
\...\PROJEKT PASSION\RENPY\...      (script[.]pyc, screenlang[.]pyc, scriptedit[.]pyc, ...)
\...\PROJEKT PASSION\LIB\PYTHON3.9\... (requests\sessions[.]pyc, urllib3\..., selectors[.]pyc)
\USERS\SL\APPDATA\ROAMING\RENPY\TOKENS\SECURITY_KEYS.TXT

WinPrefetchView file list of SETUP.EXE-A493DF79.pf

6. Dynamic Analysis — Process Monitor

Analysis was performed in Windows Sandbox (WDAG).

- Execution confirmed: `Setup[.]exe` runs (observed PIDs 3012 and 6040; PID 6040 parent PID 3800), command line `C:\Users\WDAGUtilityAccount\Downloads\Projekt_Passion_[S3_V0.17]_[Classy_Lemon]_Archive_latest_7254\Setup[.]exe`.
- Decoy runtime loading: the process reads the bundled Ren'Py Python 3.9 runtime - `lib\python3.9\contextlib[.]pyc` (19,585 bytes), `tokenize[.]pyc` (17,212 bytes), `token[.]pyc` (2,543 bytes). These `.pyc` files carry a build timestamp of 2026-02-17. This is the decoy game initializing.
- Mostly standard process init: the captured registry activity is largely normal Windows loader behavior - NLS/CodePage, Session Manager, WinSock2 catalogs (`Protocol_Catalog9`, `NameSpace_Catalog5`), `Image File Execution Options`, SafeBoot, SRP / `Safer\CodeIdentifiers`, `LongPathsEnabled`. Treat these as baseline, not as distinctive malicious indicators.
- Execution artifact (BAM): the OS recorded the run under `HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\<SID>\...\Setup[.]exe` - a useful execution artifact to cite on a victim host.
- Short runtime / anti-VM: the binary exits quickly (Process Exit, Status 0). Consistent with the local observation that it self-terminated on detecting an analysis environment, which is why Wireshark and ProcessHacker captured little locally. The full malicious behavior was observed in the ANY[.]RUN cloud sandbox (Section 8).

Procmon (process start & decoy runtime)

7. Anti-Analysis & Defense Evasion

• Detects virtualized / sandbox environments and self-terminates (matches the local behavior).
• Disables Windows Defender real-time protection and Controlled Folder Access.
• PowerShell -ExecutionPolicy Bypass; Base64-encoded commands.
• Local recon via powershell Get-Clipboard, wmic os get Caption, wmic computersystem get totalphysicalmemory.
• Exfiltration over HTTPS to Telegram, so there is no obvious local C2 socket.

8. Network / C2 — Telegram Exfiltration (key finding)

There is no traditional C2 server. Command-and-control and exfiltration ride the Telegram Bot API over HTTPS (api[.]telegram[.]org).

Telegram bots observed:

Bot 1   8262840363:AAExtAw9cg36lYX8xADbH0ygxIpbuyJwspY   chat_id 8282123288
Bot 2   8229586049:AAG4HpOyx2DcSieN0sq6mcwz5eSPGToEq-c   chat_id 6065864072

• API methods called: getMe, getUpdates, getWebhookInfo, deleteWebhook, sendMessage
• Connect / exfil message (verbatim):

⚡️Bot connected: Username: admin, Location: Germany [DE], Frankfurt am Main, ID: 3329
ℹ️Press "Help" to see the command list
💎Version: 4.3

• The getUpdates plus “Press Help to see the command list / Version 4.3” pattern indicates an interactive Telegram-controlled component (the operator issues commands through the bot), layered on the stealer.
• The host profile in that message (computer name, user, CPU, RAM, HWID, geolocation) is from the ANY.RUN sandbox, not the victim.

The process tree plus the Telegram threat section hxxps[://]any[.]run/report/7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab/14354452–8576–4851–9709–55b4183ff5bd

9. Data Targeted

• Discord tokens / sessions (primary impact here)
• Browser credentials, cookies, history, autofill (Chrome, Edge, Firefox)
• Cryptocurrency wallets / wallet extensions
• Clipboard contents
• System / host profile and geolocation

10. Campaign Linkage

The stolen Discord token enabled full account takeover with no password or 2FA prompt. The hijacked account was then used to mass-DM and tagged everyone with a fake “MrBeast” crypto-casino lure (soakwin[.]com and sibling -win domains) to the victim’s contacts, propagating the next wave. This installer is the delivery stage, the casino sites are the monetization stage of the same ecosystem.

The fake “MrBeast” Crypto-Casino Scam

11. Indicators of Compromise

MALICIOUS FILE (delivery stage)
  Setup.exe / lnstaIer.exe     PE32+ x64, 102 KB
  SHA256  7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
  SHA1    56dc080f728d7a276495d6a4371670f9ea71519b
  MD5     0323998e0e85eca5fd90d9f8ecbbd6c2
  Prefetch  SETUP[.]EXE-A493DF79[.]pf
  Archive   Projekt_Passion_[S3_V0.17]_[Classy_Lemon]_Archive_latest_7254.zip

NETWORK - C2 / EXFIL (Telegram Bot API over HTTPS)
  api[.]telegram[.]org
  Bot 8262840363:AAExtAw9cg36lYX8xADbH0ygxIpbuyJwspY   chat 8282123288
  Bot 8229586049:AAG4HpOyx2DcSieN0sq6mcwz5eSPGToEq-c   chat 6065864072

DISTRIBUTION (lure host)
  file620594.storage11x[.]cfd     (fake "DriveFiles" host)
  storage11x[.]cfd                (host domain)

EXECUTION ARTIFACT (victim host)
  HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\<SID>\...\Setup[.]exe

CAMPAIGN / MONETIZATION INFRASTRUCTURE (downstream scam pushed via the stolen token)
  Domain    soakwin[.]com   (registered 2026-06-28; VirusTotal 0/91; ScamAdviser 0/100 "Very Likely Unsafe")
  IPv4      172[.]67[.]221[.]115 / 104[.]21[.]43[.]64        (AS13335 CLOUDFLARENET)
  IPv6      2606:4700:3036::6815[:]2b40 / 2606[:]4700[:]3032[:][:]ac43[:]dd73
  NS        emely[.]ns[.]cloudflare[.]com / hassan[.]ns[.]cloudflare[.]com
  JARM      27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6   (generic Cloudflare)
  Cert      SHA1 77424cbf0521559791979280fae2036d4c9dcadd
            serial a8c8f63f82536822138c7bec148c748e   (Google Trust Services WE1)
  Registrar Fewmoretaps OU d/b/a Trustname[.]com (IANA 4318)
            Registrant: Perfect Privacy LLC, Nevis (KN)
  Email     support@soakwin[.]com -> INVALID / non-deliverable
  MX        none (domain cannot receive email - no real support channel)
  Siblings  crustwin, nozawin, noawin, bastwin, deezwin, gostwin, hustwin, yumwin,
            atuwin, vazowin, venowin, tezawin, wonkawin, dasowin, hasowin,
            bezowin159[.]pro, noswin152[.]pro, bazowin781[.]pro, besowin156[.]pro, hexowin167[.]pro

The casino domain shows every hallmark of a disposable scam node: registered the same week, Cloudflare-fronted with the origin masked, 0/91 on VirusTotal (too new to be blacklisted), 0/100 on ScamAdviser, and a support@soakwin[.]com address that is non-functional — the domain publishes no MX records, so it cannot receive email at all.

12. MITRE ATT&CK

Delivery stage (the installer):

T1566 Phishing - Discord DM with a link
T1204.002 User Execution: Malicious File
T1497 Virtualization / Sandbox Evasion
T1562.001 Impair Defenses: Disable or Modify Tools (Windows Defender)
T1027 Obfuscated Files or Information (Base64)
T1528 Steal Application Access Token (Discord)
T1555 Credentials from Password Stores / Browsers
T1115 Clipboard Data
T1102 Web Service (Telegram Bot API for C2)
T1567 Exfiltration Over Web Service

Monetization stage (account-takeover propagation):

T1078 Valid Accounts - reuse of the stolen Discord token (no password / 2FA)
T1534 Internal Spearphishing - mass-DM / @everyone of the casino lure to the victim's contacts

13. Detection & Response

If executed, treat If executed, treat the host as fully compromised:the host as fully compromised:

• Change all passwords from a clean device (the stealer grabbed browser-stored credentials).
• Discord: change password (invalidates the stolen token), log out all sessions, revoke unknown Authorized Apps, enable 2FA via an authenticator app.
• Re-enable Windows Defender real-time protection and Controlled Folder Access (the malware disabled them); remove any unknown Startup / %AppData% autoruns.
• Re-secure crypto wallets and any account with an active cookie / session.

Hunting:

• Outbound HTTPS to api[.]telegram[.]org from non-Telegram processes.
• A game Setup.exe / launcher executing followed by Defender-tamper events.
• BAM / Prefetch entries for Setup[.]exe paired with the ProjektPassion…_7254 archive name.
• DNS lookups or web requests to soakwin[.]com or any sibling -win casino domain from user endpoints.

Takedown / reporting:

• Report the Telegram bot tokens to Telegram abuse.
• Report storage11x[.]cfd (lure host) to its host/registrar and to Google Safe Browsing / urlscan.
• Report soakwin[.]com to Cloudflare Abuse (the proxy can act fastest) and submit it to Google Safe Browsing, VirusTotal, urlscan, and PhishDestroy. Registrar reports to Trustname are worth filing for the record but historically go unactioned.

14. References

- ANY.RUN (installer): hxxps[://]any[.]run/report/7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab/14354452-8576-4851-9709-55b4183ff5bd
- VirusTotal (installer): hxxps[://]www[.]virustotal[.]com/gui/file/7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- VirusTotal (domain): hxxps[://]www[.]virustotal[.]com/gui/domain/soakwin[.]com
- ScamAdviser (domain): hxxps[://]www[.]scamadviser[.]com/check-website/soakwin[.]com
- urlscan (domain): hxxps[://]urlscan[.]io/result/019f10c2-6345-7301-aa1c-ca3c2d7ca30a/
- PhishDestroy - "Trustname[.]com Exposed: Bulletproof Registrar for Scams"
- Ren'Py save-token security (`security_keys.txt`): renpy[.]org/doc/html/security[.]html

15. Four Takeaways for Everyone

1. An unsolicited “beta test my game” DM with a shortened link is a classic lure. Verify on the developer’s official page before downloading anything!

2. Don’t trust the download page or the file name. Expand shortened links before clicking, download only from the developer’s official page.

3. Watch the launch closely. A trojanized bundle runs the real game as a decoy, but the dropper leaks tells: a CMD/console window flashing for a split second, the “game” doing nothing, or a brief AV pop-up. Any of those means assume infection and go straight to #4.

4. If you think you ran it, act immediately. Disconnect from the internet, then from a clean device change your Discord password (this kills the stolen token that gives access without needing password/MFA), log out all sessions, revoke Authorized Apps, and enable 2FA. Re-enable Windows Defender (the malware turns it off), run a full scan with Malwarebytes, and change any passwords saved in your browser.

Bottom line, verify files before running, and know the warning signs after — that is what stops the chain.