Argamal RAT — Trojanized Hentai Games Deliver COM-Hijacking Implant and Downloader for Full Windows System Compromise
Argamal RAT — Trojanized Hentai Games Deliver COM-Hijacking (TL-2026-0670), also tracked as Argamal, is a high-severity malware campaign, first published 2026-06-03. It has no confirmed attribution, affects Microsoft Windows, maps to 28 MITRE ATT&CK techniques (T1027, T1041, T1053), and is covered by 9 detection rules and 41 indicators of compromise.
Key facts for TL-2026-0670
- Threat ID
- TL-2026-0670
- Also known as
- Argamal, HEUR:Trojan.Win32.Argamal.gen
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-03
- Last reviewed
- 2026-06-03
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- consumer, gaming, individuals
- Target regions
- Russia, Brazil, Germany, Vietnam
- Detection rules
- 9
- Indicators of compromise
- 41
Malware and tooling in Argamal RAT — Trojanized Hentai Games Deliver COM-Hijacking
Malware and tooling: Argamal, PowerShell
Argamal is a previously undocumented Windows RAT family disclosed by Kaspersky GReAT, distributed inside trojanized adult ('hentai') games built on RenPy and RPG Maker MV. Launching an infected game runs a multi-stage PowerShell chain that establishes COM-hijacking persistence and, after a 3-day delay, downloads an AES-encrypted RAT from GitHub via bitsadmin, granting attackers full remote control over the host.
How Argamal RAT — Trojanized Hentai Games Deliver COM-Hijacking works
Argamal is a multi-stage Windows malware family first publicly documented by Kaspersky GReAT (Mikhail Reznichenko) on 3 June 2026, though associated DLLs have been observed in the wild since at least September 2024. The threat is delivered through trojanized 'hentai' games built on the RenPy (Python) and RPG Maker MV (JavaScript) engines, distributed via dedicated adult-game catalogue websites that redirect to PixelDrain, torrent trackers such as AniRena, and gaming forums where samples are disguised as cheats.
The infection chain begins when the victim launches an infected game. A modified FFmpeg DLL bundled with the game imports DllGetClassObject from a malicious blob named natives2_blob.bin (an alternative delivery file, libpython64.dat, is dropped in game library directories). natives2_blob.bin is a script executor that runs a Base64-encoded PowerShell payload referred to as 'Stage1' after first performing sandbox and analysis-environment checks (looking for Sandboxie and Procmon64). Stage1 stores a Base64-encoded 'Stage2' script in the MI_V and MI_V2 environment variables, creates a scheduled task set to fire three days later, and establishes COM-hijacking persistence through registry modifications.
Persistence is achieved by COM hijacking under HKCU\SOFTWARE\Classes\CLSID. An initial COM object {722D0F89-B69C-4700-AE8C-4A44350E4876} is created with InprocServer32 and ShellFolder subkeys pointing at randomly named DLLs, and a final persistence COM object {B210D694-C8DF-490D-9576-9E20CDBC20BD} is hijacked so it is loaded by the \Microsoft\Windows\WindowsColorSystem\Calibration scheduled task — effectively the Windows Color System Calibration Loader — executing the implant at every user logon. Encrypted payloads are stored as settings.dat inside randomly named subdirectories of %USERPROFILE%\AppData\Local.
When the delayed task fires, Stage2 uses bitsadmin.exe to download zaesdl.dat from one of several attacker-controlled GitHub repositories. The payload is decrypted with AES-CBC using the hardcoded key 'zbcd1j9234r670eh' (the IV is identical to the key) and written to a randomly named DLL. The decrypted RAT employs position-based string substitution encryption and enumerates the running process list for 40+ security solutions (Kaspersky, Avast, McAfee, BitDefender, MalwareBytes, and others).
The RAT maintains a UDP heartbeat to port 57441 reporting detected security solutions, system startup time, input idle time, architecture, IP and username. Default C2 endpoints are dynamic-DNS domains: asper1.freeddns.org (early builds) and Winst0.kozow.com (recent builds), with a zh-CN locale fallback to country1.ignorelist.com (resolving to 127.0.0.1 or 186.158.223.35). An 'extended mode' switches to TCP port 3747 using a simple ASCII-position substitution cipher, with commands separated by the first space character. The command set provides full remote control: system control (KILL REBOOT / POWER / SELF), screen capture (SCREEN/SCREEN9 saved to ~wra1269.tmp), extensive file operations (DELETE, REN, MAKDIR, ZIPFILE/ZIPFOLDER, TAR, GETFILEDATE/SETFILEDATE timestomping, DWLOAD/UPLOAD), reconnaissance (USER, IDLE, DRIVES, FOLDEX, LFILES, OSVER), and interactive control (RUNHID/RUN, RUNDOS, MOUSE/keyboard control).
Kaspersky telemetry shows hundreds of infections, with primary victim geography in Russia, Brazil, Germany and Vietnam. The campaign is not attributed to a named actor, but Spanish-language variable names, function names and comments in the delivery scripts and website code support a medium-confidence assessment of a Spanish-speaking developer.
MITRE ATT&CK techniques used in TL-2026-0670
Defense Evasion
T1027 Obfuscated Files or Information; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1197 BITS Jobs; T1497 Virtualization/Sandbox Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1204 User Execution; T1559 Inter-Process Communication
Collection
T1056 Input Capture; T1113 Screen Capture; T1560 Archive Collected Data
Command and Control
T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1568 Dynamic Resolution; T1571 Non-Standard Port; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1124 System Time Discovery; T1518 Software Discovery
defense-impairment
Impact
Persistence
T1546 Event Triggered Execution
stealth
Affected products and versions in Argamal RAT — Trojanized Hentai Games Deliver COM-Hijacking
- Microsoft — Windows
Vulnerable versions: Windows 10; Windows 11 - RenPy — RenPy game engine (Python) — abused as delivery vehicle
Vulnerable versions: trojanized games - Enterbrain / Kadokawa — RPG Maker MV (JavaScript) — abused as delivery vehicle
Vulnerable versions: trojanized games
Remediation for Argamal RAT — Trojanized Hentai Games Deliver COM-Hijacking
Immediate actions
- Block C2 domains asper1.freeddns.org, Winst0.kozow.com, country1.ignorelist.com and IPs 186.158.223.35, 181.116.218.56 at the perimeter/DNS layer
- Hunt for COM hijacking entries under HKCU\SOFTWARE\Classes\CLSID\{722D0F89-B69C-4700-AE8C-4A44350E4876} and {B210D694-C8DF-490D-9576-9E20CDBC20BD}
- Inspect the \Microsoft\Windows\WindowsColorSystem\Calibration scheduled task for tampering and any newly created tasks set to fire ~3 days out
- Search endpoints for settings.dat in AppData\Local subdirectories and the MI_V / MI_V2 user environment variables
- Block outbound UDP/57441 and TCP/3747 to untrusted hosts
Workarounds
- Remove malicious InprocServer32 entries and the randomly named DLLs they reference, then delete the associated scheduled task and settings.dat artifacts
- Clear the MI_V and MI_V2 environment variables
Longer-term hardening
- Deploy EDR with behavioral detection for COM hijacking and bitsadmin abuse
- Restrict execution of games and software from untrusted catalogues, PixelDrain links and torrent trackers via application control
- Enable PowerShell script-block logging and monitor for Base64-encoded payloads stored in environment variables
- Egress-filter and monitor bitsadmin/BITS download activity to code-hosting services such as GitHub
Weaknesses (CWE) in Argamal RAT — Trojanized Hentai Games Deliver COM-Hijacking
CWE-506, CWE-494
Timeline of Argamal RAT — Trojanized Hentai Games Deliver COM-Hijacking
- C2 domain asper1.freeddns.org first observed; related Argamal DLLs in the wild since at least 2024.
- Fallback C2 domain country1.ignorelist.com (zh-CN locale fallback) first observed, resolving to 127.0.0.1 or 186.158.223.35.
- Recent-build C2 domain Winst0.kozow.com first observed.
- Kaspersky GReAT identifies the Argamal campaign distributing the RAT via trojanized hentai games during April 2026.
- Threadlinqs Intelligence publishes TL-2026-0670 with MITRE mapping, IOCs and detection coverage.
- Kaspersky GReAT (Mikhail Reznichenko) publishes the Argamal RAT analysis on Securelist with full IOC set.
Sources cited for Argamal RAT — Trojanized Hentai Games Deliver COM-Hijacking
- Argamal: Malware hidden in hentai games (Securelist / Kaspersky GReAT)
- MITRE ATT&CK T1546.015 — Component Object Model Hijacking
- MITRE ATT&CK T1197 — BITS Jobs
- MITRE ATT&CK T1053.005 — Scheduled Task
- MITRE ATT&CK T1497 — Virtualization/Sandbox Evasion
- MITRE ATT&CK T1568 — Dynamic Resolution (Dynamic DNS C2)
Threats related to Argamal RAT — Trojanized Hentai Games Deliver COM-Hijacking
Detection coverage for TL-2026-0670
As of 2026-06-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0670 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.