Argamal RAT — Trojanized Hentai Games Deliver COM-Hijacking Implant and Downloader for Full Windows System Compromise — Threadlinqs Intelligence
As of 2026-06-03, Argamal RAT — Trojanized Hentai Games Deliver COM-Hijacking Implant and Downloader for Full Windows System Compromise is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 41 indicators of compromise.
Threat ID: TL-2026-0670 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Argamal is a previously undocumented Windows RAT family disclosed by Kaspersky GReAT, distributed inside trojanized adult ('hentai') games built on RenPy and RPG Maker MV. Launching an infected game
Argamal is a multi-stage Windows malware family first publicly documented by Kaspersky GReAT (Mikhail Reznichenko) on 3 June 2026, though associated DLLs have been observed in the wild since at least September 2024. The threat is delivered through trojanized 'hentai' games built on the RenPy (Python) and RPG Maker MV (JavaScript) engines, distributed via dedicated adult-game catalogue websites that redirect to PixelDrain, torrent trackers such as AniRena, and gaming forums where samples are disguised as cheats.
The infection chain begins when the victim launches an infected game. A modified FFmpeg DLL bundled with the game imports DllGetClassObject from a malicious blob named natives2_blob.bin (an alternative delivery file, libpython64.dat, is dropped in game library directories). natives2_blob.bin is a script executor that runs a Base64-encoded PowerShell payload referred to as 'Stage1' after first performing sandbox and analysis-environment checks (looking for Sandboxie and Procmon64). Stage1 stores a Base64-encoded 'Stage2' script in the MI_V and MI_V2 environment variables, creates a scheduled task set to fire three days later, and establishes COM-hijacking persistence through registry modifications.
Persistence is achieved by COM hijacking under HKCU\SOFTWARE\Classes\CLSID. An initial COM object {722D0F89-B69C-4700-AE8C-4A44350E4876} is created with InprocServer32 and ShellFolder subkeys pointing at randomly named DLLs, and a final persistence COM object {B210D694-C8DF-490D-9576-9E20CDBC20BD} is hijacked so it is loaded by the \Microsoft\Windows\WindowsColorSystem\Calibration scheduled task — effectively the Windows Color System Calibration Loader — executing the implant at every user logon. Encrypted payloads are stored as settings.dat inside randomly named subdirectories of %USERPROFILE%\AppData\Local.
When the delayed task fires, Stage2 uses bitsadmin.exe to download zaesdl.dat from one of several attacker-controlled GitHub repositories. The payload is decrypted with AES-CBC using the hardcoded key 'zbcd1j9234r670eh' (the IV is identical to the key) and written to a randomly named DLL. The decrypted RAT employs position-based string substitution encryption and enumerates the running process list for 40+ security solutions (Kaspersky, Avast, McAfee, BitDefender, MalwareBytes, and others).
The RAT maintains a UDP heartbeat to port 57441 reporting detected security solutions, system startup time, input idle time, architecture, IP and username. Default C2 endpoints are dynamic-DNS domains: asper1.freeddns.org (early builds) and Winst0.kozow.com (recent builds), with a zh-CN locale fallback to country1.ignorelist.com (resolving to 127.0.0.1 or 186.158.223.35). An 'extended mode' switches to TCP port 3747 using a simple ASCII-position substitution cipher, with commands separated by the first space character. The command set provides full remote control: system control (KILL REBOOT / POWER / SELF), screen capture (SCREEN/SCREEN9 saved to ~wra1269.tmp), extensive file operations (DELETE, REN, MAKDIR, ZIPFILE/ZIPFOLDER, TAR, GETFILEDATE/SETFILEDATE timestomping, DWLOAD/UPLOAD), reconnaissance (USER, IDLE, DRIVES, FOLDEX, LFILES, OSVER), and interactive control (RUNHID/RUN, RUNDOS, MOUSE/keyboard control).
Kaspersky telemetry shows hundreds of infections, with primary victim geography in Russia, Brazil, Germany and Vietnam. The campaign is not attributed to a named actor, but Spanish-language variable names, function names and comments in the delivery scripts and website code support a medium-confidence assessment of a Spanish-speaking developer.
Weaknesses (CWE)
CWE-506, CWE-494
Target sectors: consumer, gaming, individuals
Target regions: Russia, Brazil, Germany, Vietnam
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 41 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1204, T1059, T1559, T1053, T1546, T1053, T1574, T1112, T1140, T1027