Argamal RAT Targets Players Through Trojanized Hentai Games
Summary
Kaspersky details Argamal, a RAT delivered in trojanized hentai games via websites and torrents. Its staged PowerShell loader uses COM hijacking and scheduled tasks; Kaspersky telemetry indicates hundreds of infections, mainly in four countries.
Key points
- Kaspersky found Argamal DLL variants dating back to at least 2024 and identified a campaign discovered in April 2026 targeting players of hentai games.
- In one delivery method, game archives contained legitimate files alongside a modified FFmpeg DLL and a loader DLL; other cases used payloads embedded in game files or a DLL disguised as a cheat.
- The loader runs PowerShell stages that check for analysis tools, establish persistence, and schedule a delayed payload download. The downloader retrieves an encrypted payload from GitHub and decrypts it with AES-CBC.
- Argamal persists by hijacking COM registration used by the Windows Color System Calibration Loader, enabling execution at user logon.
- The RAT can execute commands, reboot or shut down systems, take screenshots, and perform file operations. It communicates with C2 servers over UDP and, in extended mode, TCP.
- Kaspersky telemetry indicates hundreds of infections, with most victims located in Russia, Brazil, Germany, and Vietnam.
- Kaspersky assesses with medium confidence that the downloader-chain developer speaks Spanish, based on language in code comments and variable names.
Article Details
- Attack Vectors
- Trojanized hentai-game archives and torrents, including distribution through AniRena, delivered legitimate game files alongside a modified FFmpeg DLL and the malicious natives2_blob.bin loader.
- The loader executes a Base64-encoded PowerShell stage. Stage1 establishes COM hijacking persistence and schedules Stage2 to run three days later.
- Stage2 downloads and decrypts the RAT payload from GitHub using bitsadmin.exe; some variants instead package the payload in a game directory and load it through a patched library.
- The RAT communicates with changing C2 infrastructure over UDP and TCP, collects system information, and supports remote command execution, screenshots, file operations, and uploads.
- Defensive Notes
- Kaspersky reports detecting the threat as Trojan.Win32.Termixia.*, Trojan.Win32.Agent.*, HEUR:Trojan.Win32.Argamal.gen, and HEUR:Trojan-Downloader.Win32.Argamal.gen.
- The article reports that Kaspersky solutions prevented malicious activity in the earliest stages of the attack.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | asper1[.]freeddns[.]org | C2 domain used by earlier Argamal payload versions. |
| DOMAIN | country1[.]ignorelist[.]com | Locale-based fallback C2 domain used when the victim's default locale is zh-CN. |
| DOMAIN | winst0[.]kozow[.]com | C2 domain used by the latest Argamal payload versions. |
| IPV4 | 181[.]116[.]218[.]56 | Historical pDNS address associated with the first C2 domain; the article says this address was not observed in use. |
| IPV4 | 186[.]158[.]223[.]35 | C2 server address to which the article says the listed Argamal domains resolve. |
| SHA1 | 02819d200d1424882af81cb504b3e8614b32397a | Listed as a Trojan downloader hash used in the campaign. |
| SHA1 | 1405a3c5e0aeb08012484134e16cdec4ab29b4a4 | Listed by the article as an Argamal RAT payload hash. |
| SHA1 | 17f8f8f34dfa737f36182fed7ff9e9814a114058 | Listed by the article as an Argamal RAT payload hash. |
| SHA1 | 2423a5bf0fa7cb9ec09211630a5488629499691b | Listed by the article as an Argamal RAT payload hash. |
| SHA1 | 29f1d346a6e71774c7dad25b90f446b2974393df | Listed by the article as an Argamal RAT payload hash. |
| SHA1 | 42add9475e67a1ccc6a6af94b5475d3defc01b85 | SHA1 of the modified FFmpeg DLL included in infected game archives. |
| SHA1 | 535f4337f261b6da20a3c614eb13270bed2d533a | Listed by the article as an Argamal RAT payload hash. |
| SHA1 | 5f1f3689bcf23de1b280b5f35712946da0f7978f | Listed by the article as an Argamal RAT payload hash. |
| SHA1 | 69331cfdac792dc79240e6a6bb6e803eabd70beb | Listed by the article as an Argamal RAT payload hash. |
| SHA1 | 76253fb55aed707440e808ea78e7101318436b1c | Listed by the article as an Argamal RAT payload hash. |
| SHA1 | 901cfa97b1baaf908fd4a02bb52d970f576c4193 | Listed by the article as an Argamal RAT payload hash. |
| SHA1 | 954722b0c9c678b1313d1f8b204e102842dc5889 | Listed by the article as an Argamal RAT payload hash. |
| SHA1 | 9803604ec45f31f9ef75bcca1e1310d8ac1fc3a6 | Listed as a Trojan downloader hash used in the campaign. |
| SHA1 | ae4601a19d28332a3ec6ac31b385cdf53be53450 | Listed by the article as an Argamal RAT payload hash. |
| SHA1 | c2d9d48b3b10bd58cdf5df9463e3ffcd60533ff3 | Listed by the article as an Argamal RAT payload hash. |
| SHA1 | d2cb0d7a9ad2b5d4ea7c2da8aec62beb37cf36d6 | Listed by the article as an Argamal RAT payload hash. |
| SHA1 | dad26f61da7b8bccc78364411812be74c025b475 | Listed by the article as an Argamal RAT payload hash. |
| SHA1 | e05f1767c2a337910ed75e90288838d6d0541164 | Listed by the article as an Argamal RAT payload hash. |
| SHA1 | e815a9b418d09c2d4bcd074c2c0bc21406eeb22f | Listed by the article as an Argamal RAT payload hash. |
| SHA1 | edce72f59e4c1d136cd1946af70d334c19df858d | SHA1 of natives2_blob.bin, the malicious loader that executes the initial PowerShell stage. |
| SHA256 | 76253fb55aed707440e808ea78e7101318436b1c1405a3c5e0aeb08012484134 | SHA256 identified for an Argamal RAT payload. |
| URL | hxxps[:]//github[.]com/DnyP/files | GitHub repository identified by the article as a campaign delivery or hosting source. |
| URL | hxxps[:]//github[.]com/gmz159/u | GitHub repository identified by the article as used in the campaign to host or deliver payloads. |
| URL | hxxps[:]//github[.]com/mgzv/p | GitHub repository identified by the article as a campaign delivery or hosting source. |
MITRE ATT&CK
T1012 · Query RegistryStage1 and Stage2 set, read, and remove registry values used to configure COM hijacking and locate payload files.T1027 · Obfuscated Files or InformationThe article describes Base64-encoded scripts, encrypted payloads, AES-CBC decryption, and string substitution used to obscure Argamal content.T1041 · Exfiltration Over C2 ChannelThe RAT can send files to the C2 or upload them to a specified server.T1053.005 · Scheduled TaskStage1 creates a scheduled task to launch Stage2 three days later; the malware also uses the Windows Color System calibration loader task for logon execution.T1057 · Process DiscoveryThe payload checks tasklist output for security software and sends process-list information to the C2.T1059.001 · PowerShellThe loader executes a Base64-encoded PowerShell Stage1, which sets persistence data and prepares the Stage2 downloader.T1082 · System Information DiscoveryThe RAT collects system details including architecture, OS version, hostname, display settings, and mounted-drive metadata.T1095 · Non-Application Layer ProtocolThe RAT exchanges heartbeat and command traffic with its C2 over UDP and uses a separate TCP connection in extended mode.T1105 · Ingress Tool TransferStage2 uses bitsadmin.exe to download the encrypted zaesdl.dat payload from GitHub.T1106 · Native APIThe RAT executes received commands using Windows functions including ShellExecuteW, WinExec, and CreateProcessW.T1113 · Screen CaptureThe RAT can capture screenshots and send them to its C2 server.T1546.015 · Component Object Model HijackingArgamal persists by changing the InprocServer32 entry for a Windows Color System calibration COM object so the payload runs at logon.T1560.001 · Archive via UtilityRAT commands can compress selected files or folders into ZIP or TAR archives.T1571 · Non-Standard PortThe article identifies C2 communication on UDP ports 57441 and 63559 and TCP port 3747.
Malware
Vendors
Countries
BrazilKaspersky says hundreds of victims were affected, mainly in Russia, Brazil, Germany, and Vietnam.GermanyKaspersky says hundreds of victims were affected, mainly in Russia, Brazil, Germany, and Vietnam.RussiaKaspersky says hundreds of victims were affected, mainly in Russia, Brazil, Germany, and Vietnam.VietnamKaspersky says hundreds of victims were affected, mainly in Russia, Brazil, Germany, and Vietnam.