Argamal RAT — Trojanized Hentai Games Deliver COM-Hijacking Implant and Downloader for Full Windows System Compromise

Key facts for Argamal RAT

Detection coverage for Argamal RAT

As of 2026-06-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0670 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Argamal Delivery — Trojanized FFmpeg DLL Sideload & natives2_blob Script Executor

Detects the Argamal initial-access trigger: a trojanized FFmpeg DLL bundled with a RenPy/RPG-Maker game imports DllGetClassObject from the malicious blob natives2_blob.bin (or the alternative libpython64.dat dropped in game library dirs), launching the Stage1 PowerShell chain. Targets Sysmon image-load events for these delivery artifacts loaded from user-writable game directories.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1574.001, T1204.002, T1059.001, T1497.001
• Data sources: sysmon, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7
(ImageLoaded="*\\natives2_blob.bin" OR ImageLoaded="*\\libpython64.dat" OR (ImageLoaded="*\\ffmpeg*.dll" AND (ImageLoaded="*\\AppData\\Local\\*" OR ImageLoaded="*\\Games\\*" OR ImageLoaded="*\\renpy\\*")))
| eval delivery_artifact=case(like(ImageLoaded,"%natives2_blob.bin"),"natives2_blob", like(ImageLoaded,"%libpython64.dat"),"libpython64", true(),"trojanized_ffmpeg_dll")
| stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as loaded_modules by host, Image, delivery_artifact
| where Image LIKE "%python%" OR Image LIKE "%game%" OR Image LIKE "%nw.exe" OR Image LIKE "%\\AppData\\Local\\%" OR delivery_artifact!="trojanized_ffmpeg_dll"
| convert ctime(firstTime) ctime(lastTime)
| table firstTime lastTime host Image delivery_artifact loaded_modules

Microsoft KQL

DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FileName in~ ("natives2_blob.bin","libpython64.dat") or (FileName startswith "ffmpeg" and FileName endswith ".dll" and FolderPath has_any ("AppData\\Local","renpy","Games"))
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, FileName, FolderPath, SHA1
| order by Timestamp desc

Sigma

title: Argamal Trojanized FFmpeg DLL Sideload and natives2_blob Script Executor
id: 7c1f0a4e-2d3b-4e91-9a10-0670aa000101
status: experimental
description: Detects Argamal RAT delivery via a trojanized FFmpeg DLL loading the malicious natives2_blob.bin / libpython64.dat blob that launches the Stage1 PowerShell chain.
references:
    - https://securelist.com/argamal-rat-distributed-with-hentai-games/119999/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/03
tags:
    - attack.execution
    - attack.t1204.002
    - attack.persistence
    - attack.t1574.001
    - attack.defense_evasion
    - attack.t1497.001
logsource:
    product: windows
    category: image_load
detection:
    blob_load:
        ImageLoaded|endswith:
            - '\natives2_blob.bin'
            - '\libpython64.dat'
    ffmpeg_sideload:
        ImageLoaded|contains: '\ffmpeg'
        ImageLoaded|endswith: '.dll'
        ImageLoaded|contains:
            - '\AppData\Local\'
            - '\renpy\'
            - '\Games\'
    condition: blob_load or ffmpeg_sideload
falsepositives:
    - Legitimate media applications shipping their own ffmpeg.dll in user-writable directories
level: high

Known false positives:

• Legitimate media/game applications that ship a private ffmpeg.dll in AppData or game directories
• Security tooling that loads modules with similar names during analysis

Tuning notes: Allowlist known-good ffmpeg.dll SHA1 hashes used by legitimately installed games/media players. The natives2_blob.bin and libpython64.dat names are high-fidelity Argamal indicators and rarely require tuning. Pair with Stage1 PowerShell process-creation alerts for higher confidence.

• 🔒 Argamal Stage1 — Sandbox/AV Discovery Sweep & Base64 PowerShell Execution · unlock with TL Creds
• 🔒 Argamal Persistence — bitsadmin GitHub Payload Retrieval & 3-Day Delayed Scheduled Task · unlock with TL Creds
• 🔒 Argamal C2 — Dynamic-DNS Domain Resolution & Known C2 Infrastructure · unlock with TL Creds
• 🔒 Argamal Stage1->Stage2 — Base64 PowerShell Stored in MI_V/MI_V2 Environment Variables · unlock with TL Creds
• 🔒 Argamal Encrypted Payload Artifacts — [indicator] / [indicator] in AppData Local · unlock with TL Creds
• 🔒 Argamal RAT Operations — Screen Capture ([indicator]), Timestomping & Archive Collection · unlock with TL Creds
• 🔒 Argamal Persistence — COM Hijacking of WindowsColorSystem Calibration CLSID · unlock with TL Creds
• 🔒 Argamal C2 — Non-Standard UDP/57441 Heartbeat & TCP/3747 Extended Mode · unlock with TL Creds

Indicators of compromise for Argamal RAT

As of 2026-06-03, Threadlinqs Intelligence tracks 41 indicators of compromise for TL-2026-0670.

Sample indicators (3 of 41)

• IP address: 186.158.223[.]35
• Domain: asper1[.]freeddns[.]org
• URL: hxxps://github[.]com/gmz159/u

Defanged, TLP:CLEAR. Full set of 41 indicators: unlock with TL Creds.

How Argamal RAT works

Argamal is a multi-stage Windows malware family first publicly documented by Kaspersky GReAT (Mikhail Reznichenko) on 3 June 2026, though associated DLLs have been observed in the wild since at least September 2024. The threat is delivered through trojanized 'hentai' games built on the RenPy (Python) and RPG Maker MV (JavaScript) engines, distributed via dedicated adult-game catalogue websites that redirect to PixelDrain, torrent trackers such as AniRena, and gaming forums where samples are disguised as cheats.

The infection chain begins when the victim launches an infected game. A modified FFmpeg DLL bundled with the game imports DllGetClassObject from a malicious blob named natives2_blob.bin (an alternative delivery file, libpython64.dat, is dropped in game library directories). natives2_blob.bin is a script executor that runs a Base64-encoded PowerShell payload referred to as 'Stage1' after first performing sandbox and analysis-environment checks (looking for Sandboxie and Procmon64). Stage1 stores a Base64-encoded 'Stage2' script in the MI_V and MI_V2 environment variables, creates a scheduled task set to fire three days later, and establishes COM-hijacking persistence through registry modifications.

Persistence is achieved by COM hijacking under HKCU\SOFTWARE\Classes\CLSID. An initial COM object {722D0F89-B69C-4700-AE8C-4A44350E4876} is created with InprocServer32 and ShellFolder subkeys pointing at randomly named DLLs, and a final persistence COM object {B210D694-C8DF-490D-9576-9E20CDBC20BD} is hijacked so it is loaded by the \Microsoft\Windows\WindowsColorSystem\Calibration scheduled task — effectively the Windows Color System Calibration Loader — executing the implant at every user logon. Encrypted payloads are stored as settings.dat inside randomly named subdirectories of %USERPROFILE%\AppData\Local.

When the delayed task fires, Stage2 uses bitsadmin.exe to download zaesdl.dat from one of several attacker-controlled GitHub repositories. The payload is decrypted with AES-CBC using the hardcoded key 'zbcd1j9234r670eh' (the IV is identical to the key) and written to a randomly named DLL. The decrypted RAT employs position-based string substitution encryption and enumerates the running process list for 40+ security solutions (Kaspersky, Avast, McAfee, BitDefender, MalwareBytes, and others).

The RAT maintains a UDP heartbeat to port 57441 reporting detected security solutions, system startup time, input idle time, architecture, IP and username. Default C2 endpoints are dynamic-DNS domains: asper1.freeddns.org (early builds) and Winst0.kozow.com (recent builds), with a zh-CN locale fallback to country1.ignorelist.com (resolving to 127.0.0.1 or 186.158.223.35). An 'extended mode' switches to TCP port 3747 using a simple ASCII-position substitution cipher, with commands separated by the first space character. The command set provides full remote control: system control (KILL REBOOT / POWER / SELF), screen capture (SCREEN/SCREEN9 saved to ~wra1269.tmp), extensive file operations (DELETE, REN, MAKDIR, ZIPFILE/ZIPFOLDER, TAR, GETFILEDATE/SETFILEDATE timestomping, DWLOAD/UPLOAD), reconnaissance (USER, IDLE, DRIVES, FOLDEX, LFILES, OSVER), and interactive control (RUNHID/RUN, RUNDOS, MOUSE/keyboard control).

Kaspersky telemetry shows hundreds of infections, with primary victim geography in Russia, Brazil, Germany and Vietnam. The campaign is not attributed to a named actor, but Spanish-language variable names, function names and comments in the delivery scripts and website code support a medium-confidence assessment of a Spanish-speaking developer.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1197 BITS Jobs; T1497 Virtualization/Sandbox Evasion

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1204 User Execution; T1559 Inter-Process Communication

Collection

T1056 Input Capture; T1113 Screen Capture; T1560 Archive Collected Data

Command and Control

T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1568 Dynamic Resolution; T1571 Non-Standard Port; T1573 Encrypted Channel

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1124 System Time Discovery; T1518 Software Discovery

defense-impairment

T1112 Modify Registry

Impact

T1529 System Shutdown/Reboot

Persistence

T1546 Event Triggered Execution

stealth

T1574 Hijack Execution Flow

Remediation for Argamal RAT

Immediate actions

• Block C2 domains asper1.freeddns.org, Winst0.kozow.com, country1.ignorelist.com and IPs 186.158.223.35, 181.116.218.56 at the perimeter/DNS layer
• Hunt for COM hijacking entries under HKCU\SOFTWARE\Classes\CLSID\{722D0F89-B69C-4700-AE8C-4A44350E4876} and {B210D694-C8DF-490D-9576-9E20CDBC20BD}
• Inspect the \Microsoft\Windows\WindowsColorSystem\Calibration scheduled task for tampering and any newly created tasks set to fire ~3 days out
• Search endpoints for settings.dat in AppData\Local subdirectories and the MI_V / MI_V2 user environment variables
• Block outbound UDP/57441 and TCP/3747 to untrusted hosts

Workarounds

• Remove malicious InprocServer32 entries and the randomly named DLLs they reference, then delete the associated scheduled task and settings.dat artifacts
• Clear the MI_V and MI_V2 environment variables

Longer-term hardening

• Deploy EDR with behavioral detection for COM hijacking and bitsadmin abuse
• Restrict execution of games and software from untrusted catalogues, PixelDrain links and torrent trackers via application control
• Enable PowerShell script-block logging and monitor for Base64-encoded payloads stored in environment variables
• Egress-filter and monitor bitsadmin/BITS download activity to code-hosting services such as GitHub

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows 10; Windows 11
• RenPy — RenPy game engine (Python) — abused as delivery vehicle
  Vulnerable versions: trojanized games
• Enterbrain / Kadokawa — RPG Maker MV (JavaScript) — abused as delivery vehicle
  Vulnerable versions: trojanized games

Timeline of Argamal RAT

• 2024-09-16 C2 domain locked-ioc-31 first observed; related Argamal DLLs in the wild since at least 2024.
• 2025-09-10 Fallback C2 domain locked-ioc-30 (zh-CN locale fallback) first observed, resolving to 127.0.0.1 or locked-ioc-37.
• 2026-04-26 Recent-build C2 domain locked-ioc-35 first observed.
• 2026-04-30 Kaspersky GReAT identifies the Argamal campaign distributing the RAT via trojanized hentai games during April 2026.
• 2026-06-03 Threadlinqs Intelligence publishes TL-2026-0670 with MITRE mapping, IOCs and detection coverage.
• 2026-06-03 Kaspersky GReAT (Mikhail Reznichenko) publishes the Argamal RAT analysis on Securelist with full IOC set.

Sources cited for Argamal RAT

• Argamal: Malware hidden in hentai games (Securelist / Kaspersky GReAT) Kaspersky Securelist · Research · 2026-06-03
• MITRE ATT&CK T1546.015 — Component Object Model Hijacking MITRE · Research · 2026-06-03
• MITRE ATT&CK T1197 — BITS Jobs MITRE · Research · 2026-06-03
• MITRE ATT&CK T1053.005 — Scheduled Task MITRE · Research · 2026-06-03
• MITRE ATT&CK T1497 — Virtualization/Sandbox Evasion MITRE · Research · 2026-06-03
• MITRE ATT&CK T1568 — Dynamic Resolution (Dynamic DNS C2) MITRE · Research · 2026-06-03

Threats related to Argamal RAT

• Nimbus RAT (BackupBOX) — Microsoft Teams Vishing + Quick Assist Delivery of a Self-Contained Java RAT Using Google Drive/Sheets for C2 (BlackSuit Affiliate)
• Xctdoor Backdoor Delivered via Resume-Themed LNK Files, PowerShell/VBScript Loaders, and ProximityUxHost.exe DLL Side-Loading (Andariel)

Previous and next in malware

• WeedHack MaaS Infostealer — Trojanized Minecraft Mods/Clients via YouTube + SEO Poisoning, 36-Browser & Crypto-Wallet Credential Theft with Paid RAT Tier (CVE-N/A) Previous report
• Open-Source/Freeware Impersonation + Click-Hijacking TDS Ecosystem Delivering RemusStealer, AnimateClipper & SessionGate Next report