Horse Museum: Taking Apart a Private Star Stable Launcher Distributed over Tor

This post analyzes an installer that was handed out as an invite to a private Star Stable Online server. The delivery, an onion link serving an executable and an opaque config file, has every trait of a stealer campaign. Taking apart the installer, the launcher, the signed profile, and the encrypted game package shows something else: a private-server client that talks to its account backend over Tor, proxies winmm.dll into the game, patches the client in memory, and only learns the real game server address after login.

An Invite That Looks Like a Malware Drop

The invite consists of a code and short instructions: install Tor, open the link, sign in, download setup.exe and cfg.hors, run the installer, then import the config. The word “Link” is a hyperlink to http://2slqbzmg7k56iwrmbxensn7nrjufubtdbhpanbix5gwusn53vpl454yd.onion/.

An onion site that serves an installer together with a second, unexplained file is the typical shape of a malware drop. The working hypothesis for the analysis was therefore a credential stealer using a horse game as the lure.

The onion site itself is a minimal, well-structured HTML page. The Content-Security-Policy header restricts all resources to 'self', and the page links to a Discord server (discord.gg/horseempire), a download page, and a login page. Registration is invite-only: the /api/registration/status endpoint returns {"mode": "invite"}.

Inside the NSIS Installer

setup.exe is a Nullsoft Scriptable Install System package [1] of 18,122,287 bytes.

SHA-256: 4e5129b0b02835ceb7de51ab572eb89e2c430fa3ff1ab105708f28987d6e99f0

7-Zip reads the archive: solid Deflate compression, 33,704 bytes of headers, and a 109,568-byte stub. It contains the following members:

The wizard bitmap and the two plugin DLLs belong to the installer UI. The actual payload is HorseLauncher.exe and a complete copy of tor.exe. The sixth member, runtimes.exe, is a nested NSIS installer that bundles the game’s runtime dependencies (see below).

Because the archive is a single solid block, 7-Zip attributes the entire compressed size to the first file, and no member can be extracted on its own. 7-Zip versions before 23.01 abort on this archive with BadCmd=13 when trying to list it; later versions extract all six members. Cutting even two megabytes off the end makes the whole archive unreadable, so the installer cannot be trimmed below a 16 MB sandbox upload limit.

runtimes.exe: a Second NSIS Installer Inside the First

runtimes.exe is itself a 13,280,976-byte NSIS installer. Its manifest requests requireAdministrator execution level. Extracting it reveals three files:

All three carry valid Authenticode signatures from Microsoft. The NSIS script disassembly confirms what they do: vc14_x86.exe is installed with /install /quiet /norestart, vc2013_x86.exe with the same flags, and dxwebsetup.exe with /Q. The script checks the exit code of each, showing "Could not start Visual C++ runtime" or "DirectX web installer failed (code $0). Check your Internet connection and try setup again." on failure.

The outer installer calls runtimes.exe via ShellExecuteExW with the runas verb, waits for it with WaitForSingleObject, and checks the exit code. If it fails, the user sees "Game runtimes were not installed (code $0). Run setup again and approve the administrator prompt, or uncheck runtimes if they are already installed." There is no code in runtimes.exe beyond the three Microsoft redistributable installers.

The Outer Installer Script

Disassembly of the outer NSIS script shows what setup.exe does beyond extracting files:

1. Writes HorseLauncher.exe and tor.exe to $INSTDIR.
2. Calls kernel32::CreateFileW on HorseLauncher.exe to verify the install directory is writable. If not: "Cannot update this file. Close the launcher and try again, or choose a writable folder."
3. Runs runtimes.exe elevated (see above).
4. Creates a desktop shortcut (Horse Launcher.lnk) and a Start Menu entry under Programs\HorseLauncher.
5. Writes an uninstall entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\HorseLauncher with DisplayName, UninstallString, DisplayIcon, EstimatedSize (12099 KB), and NoModify/NoRepair set to 1.
6. Calls IsWow64Process2 and IsWow64Process to detect the architecture.

The script does not touch any browser profile, run key, scheduled task, or service. It does not download anything at install time.

The Launcher PE

HorseLauncher.exe is a 64-bit GUI PE [2] of 1,904,640 bytes. It is not packed; section entropy ranges from 4.68 (.data) to 6.95 (.rsrc), consistent with plain compiled code plus embedded resources. The seven sections are .text, .rdata, .data, .pdata, .fptable, .rsrc, and .reloc.

SHA-256: 93f83d0ead20be789340a3edd26557416c425e09fb2250077293a57ea58c1337

The import table references 15 DLLs: KERNEL32 (160 functions), USER32 (50), WS2_32 (36), CRYPT32 (18), bcrypt (15), ADVAPI32 (12), WINHTTP (12), winsqlite3 (9), GDI32 (6), ole32 (4), Cabinet (3), COMCTL32 (3), IPHLPAPI (2), SHELL32 (2), and Secur32 (1). The launcher uses cpp-httplib as an embedded HTTP server (the demangled C++ symbols are visible in the binary) and libcurl for outbound requests, including aws-sigv4 support for the SwissTransfer download authentication.

The program goes by several names. Its version resources say Horse Launcher 2.0 and Star Riders Launcher 1.0. The invite video shows a Horse Museum logo on the Tor Browser start page, and Horse Museum is also the directory the launcher creates for Tor: %LOCALAPPDATA%\HorseMuseum\Tor, resolved through FOLDERID_LocalAppData [3]. The server profile calls itself Horse Empire. All of these names refer to the same program.

No Stealer Code in the Launcher

The first pass targeted the usual stealer surface, and none of it is present. HorseLauncher.exe has no references to Chrome, Firefox, Discord, Telegram, or cryptocurrency wallets, no Run key persistence, and no WriteProcessMemory or CreateRemoteThread.

The few suspicious-looking pieces have mundane explanations. The only SQL-like string is launcher_hash, read from a JSON blob as part of a self-check. CryptProtectData is imported because the launcher can remember the account password, which it stores as RememberedPassword under HKCU\Software\StarRiders\Launcher. The launcher can write text to the clipboard, but it never reads from it.

The launcher also knows the SHA-256 hash of the bundled tor.exe (60c45b01938c799862e511a9a5bab12f959a819c6264a24502edc342165f570c, matching the actual file) and checks it before starting the Tor process.

The launcher contains none of the stealer functionality the delivery suggested. What it does contain is a client for a private game server.

Three Pairs of Embedded DLLs

HorseLauncher.exe embeds three pairs of 32-bit DLLs as RT_RCDATA resources, one pair for each supported client year. The resource IDs follow a consistent scheme: 2014 + 1 or 2 for 2014, 2018 + 1 or 2 for 2018, 2020 + 1 or 2 for 2020. The first resource in each pair is winmm.dll, the second is patch.dll.

All six are x86 PE32 DLLs. All three winmm.dll variants contain the strings HORSE_HTTP_PORT, 127.0.0.1, and http://. The 2018 and 2020 variants additionally contain whatsnew.starstable.com and whatsnew.stage.starstable.com; the 2014 variant does not. The 2014 variant uniquely imports USER32.dll for GetAsyncKeyState; the 2018 and 2020 variants do not import USER32 at all for the proxy itself (the launcher imports it separately).

All three patch.dll variants export four functions by ordinal only, import only KERNEL32 and the VC++ runtime, and contain the strings VirtualProtect, VirtualAlloc, and FlushInstructionCache. None of the six DLLs has any network imports beyond WININET in the winmm.dll variants.

The winmm.dll proxies export the real WinMM functions and forward them to the system copy, which they load from System32. Windows searches the application directory before System32 [4], so SSOClient.exe loads the proxy instead of the real library. This is the standard DLL proxy technique: the host keeps working, and the proxy’s code runs first.

The proxy uses WININET to talk to 127.0.0.1 on the port named by HORSE_HTTP_PORT. Where present, the whatsnew hostnames cause the patched client to redirect its news requests away from the official Star Stable servers.

patch.dll is the memory-patching component. Its three notable KERNEL32 imports, VirtualProtect, VirtualAlloc, and FlushInstructionCache, are the standard combination for rewriting executable code in a running process. The DLL expects to run inside SSOClient.exe or PXStudioRuntimeMMO.exe.

Tor for Accounts, Direct TCP for the Game

The profile parser accepts only a v3 onion address as the account host: 56 base32 characters followed by .onion [5]. A regular domain is rejected. The launcher then starts the bundled tor.exe with --DataDirectory, --SocksPort, --ControlPort, --CookieAuthentication, --CookieAuthFile, --ClientOnly, and --SafeSocks, and routes login, downloads, and code redemption through it. The launcher monitors the Tor control port for Bootstrapped 100% and status/circuit-established=1 before enabling login.

The game connection does not use Tor. For each client year the profile holds a host and a port, which the launcher hands to the game as NetworkServer and NetworkServerPort. NetworkLauncherServer is set to 127.0.0.1 and UseNewServerConnect to 1, so the game talks to the launcher on localhost. The launcher talks to the real server and passes a NetworkTicket once it has one.

These connections are SOCK_STREAM / IPPROTO_TCP sockets. The only other socket is an IPv6 SOCK_DGRAM socket that is created and immediately closed, which is a UDP availability check rather than part of the game protocol. The embedded DLLs import neither sendto nor recvfrom.

The Signed and Encrypted cfg.hors Profile

cfg.hors is 4,205,180 bytes. The file layout is:

0x00  magic "HORS" (0x53524F48)
0x04  version (u32, must be 1)
0x08  ciphertext length (u32, file size minus 104)
0x0C  12-byte AES-GCM nonce
0x18  ciphertext
      16-byte AES-GCM tag
      64-byte ECDSA P-256 signature

The last 64 bytes are an ECDSA P-256 signature over everything before them. The public key ships inside the launcher as a BCrypt blob with magic 0x31534345 (ECS1, BCRYPT_ECDSA_PUBLIC_P256_MAGIC), key size 0x20, and the X and Y coordinates. The algorithm string is ECDSA_P256.

The payload is encrypted with AES-256-GCM via BCryptDecrypt using the ChainingModeGCM chaining mode [6]. The first 24 bytes of the file (magic, version, and ciphertext length) serve as additional authenticated data, so the header is covered by the tag. The 32-byte key is a constant at file offset 0x1438F0 in HorseLauncher.exe:

378aa25e7de20d75caa84957b795858fefd395c4274868ff6f137ba2ec67699a

Decryption yields 4,205,076 bytes of plaintext. A truncated file fails the tag check. The plaintext structure is:

u32    version (1)
lp     profile id         "horse-empire"
lp     profile name       "Horse Empire"
lp     account host       "2slqbzmg7k56iwrmbxensn7nrjufubtdbhpanbix5gwusn53vpl454yd.onion"
u16    account port        80
lp     api path           "/api/launcher/"
lp     note               "Thanks for the Discord art Bunni!"
u8     game count          3
       for each game:
         u16   year number
         lp    year string
         lp    game host
         u16   game port
u8     image count          4
       for each image:
         u8    type index (0, 1, 2, 3)
         u32   size
         raw   image data

Where lp is a uint16 length prefix followed by that many bytes. The three game entries:

The four images are two JPEGs (237 KB and 3,528 KB) and two PNGs (54 KB and 288 KB). There is no executable code in the profile. The plaintext ends exactly after the last image, with zero bytes remaining.

77.233.223.176 belongs to Timeweb in Russia (77.233.223.0/24, AS9123, netname TW-Cloud). TCP connections to ports 80, 443, 13000, 18000, and 20000 were refused, and UDP probes to the three game ports received no response.

The Launcher API

The launcher’s strings reveal a comprehensive REST API routed through Tor to the onion backend. The endpoints fall into four categories:

Launcher endpoints (all under /api/launcher/):

Web endpoints (under /api/web/): login, session, logout, download, payments/create, payments/history, reseller/create, reseller/history. These are CORS-restricted; requests from outside the site return "Origin is not allowed.".

Game relay endpoints (under /launcher/): game_data/, update_ticket/, reserve_character_name/, create_character_horse/. These appear to be proxied to the game server.

Other endpoints: /api/register, /api/profile (returns character creation defaults including first_name, horse1, face_style, etc.), /api/registration/status, /api/security/manifest, /api/archive-options, /api/n/ (news).

Login Replaces the Game Server Address

The login endpoint takes form-encoded username and password at /api/launcher/login. The response includes the session token, account metadata, and all game server addresses:

{
  "ok": true,
  "token": "286db87c...25d7b",
  "uid": 2007,
  "username": "victorspet",
  "star_coins": 0,
  "subscription_level": 70,
  "game_master": false,
  "moderator": false,
  "server_host": "162.35.243.182",
  "server_port": "20000",
  "game_2020_host": "162.35.243.182",
  "game_2020_port": "20000",
  "game_2014_host": "162.35.243.182",
  "game_2014_port": "13000",
  "game_2018_host": "162.35.243.182",
  "game_2018_port": "18000"
}

The game server address in the signed profile (77.233.223.176, Timeweb, Russia) is stale. The login response overwrites it with 162.35.243.182. The ports remain the same. A session token validation via /api/launcher/session returns identical fields, confirming the token is stateless with respect to address resolution.

162.35.243.182 falls in the range 162.35.242.0 to 162.35.243.255, netname moula-world-llc, country US, origin AS212477 [7]. TCP connections to the three game ports timed out after 8 seconds. Unlike the Timeweb host, which refused connections immediately, this host silently dropped them.

The Integrity and Ticket Flow

The launch sequence requires three steps after login:

1. Download: POST to /api/launcher/download with token and game (e.g., 2020). The response includes a SwissTransfer URL, the package size, its SHA-256 hash, and a 32-byte AES-256-GCM key.

2. Integrity check: POST to /api/launcher/integrity with token, game, and build_id. The server compares the build ID against its current manifest. If the client is outdated, it returns {"ok": false, "update_available": true}. If current, it returns {"ok": true}.

3. Launch ticket: POST to /api/launcher/launch-ticket with token and game. This only succeeds after a passing integrity check. The response is a single-use ticket: {"ok": true, "ticket": "363a4b7c...6264"}.

The server publishes integrity manifests at /api/security/manifest?game=<name>. These list every file the client directory must contain, one SHA-256 hash per line. The launcher manifest covers only HorseLauncher.exe itself. The game manifests list 7 to 9 files each:

2020 manifest (9 files): Data.ccx, fmod.dll, fmod_distance_filter.dll, fmod_gain.dll, fmodstudio.dll, libxl.dll, patch.dll, SSOClient.exe, winmm.dll.

2018 manifest (7 files): Data.ccx, fmod.dll, fmodstudio.dll, InputActions.ini, patch.dll, PXStudioRuntimeMMO.exe, winmm.dll.

2014 manifest (8 files): Data.cch, fmod.dll, fmodstudio.dll, patch.dll, PluginData.cch, PXStudioRuntimeBrowserDLL.pxzi, PXStudioRuntimeMMO.exe, winmm.dll.

Every hash in the 2020 and 2014 manifests matches the corresponding hash from the HORSBOX1 packages and the embedded DLL resources. The server verifies that the launcher and the game files are exactly the versions it distributed.

The HORSBOX1 Game Package

setup.exe does not contain the game itself. The /api/launcher/download endpoint returns a SwissTransfer link, a file size, a SHA-256 hash, and a 32-byte key. The download response for each game year on September 29, 2026:

The 2020 package was downloaded and analyzed for the original article. Its SHA-256 was b0173cdd55c0ed3bc5ad0f5a473044589a524d7e25ef5058c27bfa15836a9f8f with variant A; the current download returns a different hash with variant C, confirming the server rotates packages.

The file starts with the magic HORSBOX1. It is neither a ZIP archive nor a client executable with a prepended header, but a custom encrypted container. The launcher reads a 0x48-byte header:

The index occupies the last bytes of the file. The launcher seeks to the index offset and decrypts it with AES-256-GCM, using the key from the download JSON and the first 0x28 header bytes as additional authenticated data. With these inputs the tag verifies.

The decrypted index starts with a u32 version (1) and a u32 chunk size (0x400000, 4 MiB). Three u32 length-prefixed strings follow: the client year, the release hash (an MD5 hex string), and a single-letter variant. Then a u64 total plaintext size and a u32 file count. Unlike cfg.hors, which uses u16 length prefixes, the HORSBOX1 index uses u32 prefixes throughout.

Each file record holds a u32-prefixed name, the plaintext size as u64, a 32-byte SHA-256 hash, and a u32 chunk count followed by that many chunk entries. Each chunk entry is 49 bytes: a u64 file offset, three u32 sizes (ciphertext, plaintext, stored), a u8 flag, a 12-byte nonce, and a 16-byte GCM tag. Every flag in the analyzed packages is 0, indicating no compression. The additional authenticated data for a chunk is HORSBOX1 followed by five little-endian u32 values (version, file index, chunk index, plaintext size, ciphertext size) and the flag byte.

Every decrypted file matched the SHA-256 hash stored in the index. These hashes are what the “File verification required” error refers to: the launcher hashes the files it has just written and only then requests a ticket.

Contents of the 2014 Package (Independently Verified)

The 2014 package was downloaded (955,644,456 bytes, SHA-256 eba302005515fb333490a63080d702b13186711a3df597ed88e8868f3faeca0d), its index decrypted, all 18,762 files catalogued, and a random sample of 100 files across all file types decrypted and verified against their index hashes. All 100 passed. The eight executables and DLLs were fully extracted and analyzed:

Two additional .dylib files (macOS builds of the FMOD plugins, 42 KB and 41 KB) are included but unused on Windows.

PXStudioRuntimeMMO.exe imports 12 DLLs: KERNEL32, USER32, GDI32, SHELL32, WININET, WINMM, WS2_32, DSOUND, d3d9, d3dx9_36, COMDLG32, and ole32. The SHELL32 import is ShellExecuteA (for opening URLs, standard in game clients). The WININET imports are InternetOpenA, InternetConnectA, HttpOpenRequestA, HttpSendRequestA, InternetReadFile, and InternetCloseHandle, covering HTTP asset requests. There are no imports for CreateRemoteThread, WriteProcessMemory, or any injection API. Section entropy ranges from 4.11 (.data) to 6.58 (.rsrc), consistent with unpacked native code.

The remaining 18,752 files are game data: .pte textures (6,799 files), .pmt material definitions (6,485), .pme meshes (2,440), .pan animations (1,163), .pso shaders (997), .pxo objects (341), .pco collision (202), .psm scene maps (185), .wav audio (101), and smaller counts of .pxw, .pfo, .ed, .tei, .ter, and .cch files. No file with a game-data extension contained a PE header or suspicious strings (cmd.exe, powershell, mimikatz, keylog, stealer) in its first 4 KB.

The 2014 package is the Star Stable 2014 client (PXStudio engine build) plus the same winmm.dll proxy and patch.dll that the launcher carries as embedded resources. No additional executables, no stealer code, no unexpected binaries.

Contents of the 2020 Package

The relevant files in the package:

SSOClient.exe is a PE32 binary with CompanyName Star Stable Entertainment AB, ProductName Star Stable Online, FileVersion 51.95333, and ProductVersion PXEngine 51. It contains the build path PXRelease2020_51\Projects\StarStableOnline, imports WINMM.dll, FMOD, OpenGL32, and WinHTTP, and has a CPADinfo section. Its OpenGL 3.0 warning string matches the text of the official client.

winmm.dll and patch.dll are byte-identical to the 2020 pair embedded in HorseLauncher.exe as resources 20201 and 20202, with the same HORSE_HTTP_PORT, http://127.0.0.1:, and news host strings and the same three memory imports in patch.dll.

The remaining program files are the usual dependencies of the 2020 client. fmod.dll is FMOD 1.10.1 from Firelight Technologies, accompanied by fmodstudio.dll and two small FMOD plugins; Mach-O .dylib builds of those plugins sit in the same tree. crashpad_handler.exe is Chromium’s crash reporter. libxl.dll is LibXL 3.8.1.0 from XLware, and SSOClient.exe already references it by name.

The bulk of the package is game data: Data.ccx and PackFiles/p_00000000.csa through p_00000012.csa, each with a matching .csaheader. The headers list scenes, animations, and models (.scene, .pan, .pme, .pte) and do not reference any additional executable.

The package is the 2020 Star Stable client plus the same two DLLs the launcher already carries. None of the 40 files contains a separate stealer.

Host Artifacts

For identifying an installation on a machine:

The game process receives NetworkServer, NetworkServerPort, NetworkTicket, NetworkUserName, NetworkUserId, NetworkLauncherServer, NetworkLauncherHash, and UseNewServerConnect from the launcher.

Assessment

Despite its delivery, the installer is a private Star Stable Online client and not a stealer. Every component has been accounted for:

• The outer NSIS installer writes the launcher, Tor, and runtime redistributables. Its script creates shortcuts and an uninstall entry; it touches no browser profiles, run keys, or services.
• The nested runtimes.exe contains only three Microsoft-signed redistributables (VC++ 2013, VC++ 2015-2022, DirectX).
• The launcher binary imports 15 DLLs, none of which are associated with credential theft. Its embedded DLLs are winmm.dll proxies and in-memory patchers, not injectors.
• The cfg.hors profile contains server metadata and four images, no code.
• The HORSBOX1 2014 game package was independently downloaded (955 MB), its custom encrypted container format reverse-engineered, and all 18,762 files catalogued. A random sample of 100 files was decrypted and verified against the index hashes with zero failures. All eight executables and DLLs were extracted and analyzed: the game engine (PXStudioRuntimeMMO.exe), FMOD audio libraries, and the same winmm.dll proxy and patch.dll that the launcher embeds. No hidden executables, no stealer code, no suspicious strings in any sampled file.
• The 2020 package contains the same pattern: the Star Stable 2020 client (SSOClient.exe with PXEngine 51) plus the same proxy DLLs.
• The winmm.dll and patch.dll files from the 2014 package are byte-identical (SHA-256 match) to the ones embedded in the launcher as resources 20141 and 20142. The same holds for the 2020 pair.
• The API surface covers account management, game downloads, integrity checking, and launch tickets. There are no endpoints for exfiltrating browser data, Discord tokens, or wallet files.
• The server enforces file integrity through SHA-256 manifests and issues launch tickets only after verification passes.

The game server address in the signed profile is a placeholder. The onion backend replaces it at login, and it has already moved once (from Timeweb in Russia to Moula World LLC in the US). The download packages rotate variants. The backend can change the game server address, the download links, or the package contents at any time without touching setup.exe or cfg.hors.

Both game server addresses were unreachable during testing (the Timeweb host refused connections, the US host silently dropped them), so the game protocol itself was not observed.

Drafted with LLM assistance from setup.exe, HorseLauncher.exe, cfg.hors, the onion backend API (login, session, download, integrity, ticket, manifest, profile, and registration endpoints queried on September 29, 2026), the 2014 HORSBOX1 package (955 MB, independently downloaded, decrypted, and verified: all 18,762 files catalogued, 100-file random sample passed SHA-256 verification, all executables extracted and analyzed), and the 2020 HORSBOX1 package. Reviewed against the samples.

References

[1] Nullsoft Scriptable Install System, https://nsis.sourceforge.io/Main_Page

[2] Microsoft, PE Format, https://learn.microsoft.com/en-us/windows/win32/debug/pe-format

[3] Microsoft, KNOWNFOLDERID, FOLDERID_LocalAppData, https://learn.microsoft.com/en-us/windows/win32/shell/knownfolderid

[4] Microsoft, Dynamic-Link Library Search Order, https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order

[5] Tor Project, Onion services, https://community.torproject.org/onion-services/overview/

[6] Microsoft, BCryptDecrypt, https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptdecrypt

[7] RIPE Database query for 162.35.243.182, https://apps.db.ripe.net/db-web-ui/query?searchtext=162.35.243.182