# Argamal RAT — Trojanized Hentai Games Deliver COM-Hijacking Implant and Downloader for Full Windows System Compromise

> Argamal is a previously undocumented Windows RAT family disclosed by Kaspersky GReAT, distributed inside trojanized adult ('hentai') games built on RenPy and RPG Maker MV. Launching an infected game runs a multi-stage PowerShell chain that establishes COM-hijacking persistence and, after a 3-day delay, downloads an AES-encrypted RAT from GitHub via bitsadmin, granting attackers full remote control over the host.

- **Published:** 2026-06-03T00:00:00Z
- **Last reviewed:** 2026-06-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0670
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-argamal-rat-tl-2026-0670.webp?v=d1fe5383 (Threadlinqs threat intel: Argamal RAT via Trojanized Adult Games: Detection & IOCs (TL-2026-0670) — High severity, 41 IOCs, 9 detection rules.)
- **ID:** TL-2026-0670
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 41 (3 shown free below)

## Description

Argamal is a multi-stage Windows malware family first publicly documented by Kaspersky GReAT (Mikhail Reznichenko) on 3 June 2026, though associated DLLs have been observed in the wild since at least September 2024. The threat is delivered through trojanized 'hentai' games built on the RenPy (Python) and RPG Maker MV (JavaScript) engines, distributed via dedicated adult-game catalogue websites that redirect to PixelDrain, torrent trackers such as AniRena, and gaming forums where samples are disguised as cheats.

The infection chain begins when the victim launches an infected game. A modified FFmpeg DLL bundled with the game imports DllGetClassObject from a malicious blob named natives2_blob.bin (an alternative delivery file, libpython64.dat, is dropped in game library directories). natives2_blob.bin is a script executor that runs a Base64-encoded PowerShell payload referred to as 'Stage1' after first performing sandbox and analysis-environment checks (looking for Sandboxie and Procmon64). Stage1 stores a Base64-encoded 'Stage2' script in the MI_V and MI_V2 environment variables, creates a scheduled task set to fire three days later, and establishes COM-hijacking persistence through registry modifications.

Persistence is achieved by COM hijacking under HKCU\SOFTWARE\Classes\CLSID. An initial COM object {722D0F89-B69C-4700-AE8C-4A44350E4876} is created with InprocServer32 and ShellFolder subkeys pointing at randomly named DLLs, and a final persistence COM object {B210D694-C8DF-490D-9576-9E20CDBC20BD} is hijacked so it is loaded by the \Microsoft\Windows\WindowsColorSystem\Calibration scheduled task — effectively the Windows Color System Calibration Loader — executing the implant at every user logon. Encrypted payloads are stored as settings.dat inside randomly named subdirectories of %USERPROFILE%\AppData\Local.

When the delayed task fires, Stage2 uses bitsadmin.exe to download zaesdl.dat from one of several attacker-controlled GitHub repositories. The payload is decrypted with AES-CBC using the hardcoded key 'zbcd1j9234r670eh' (the IV is identical to the key) and written to a randomly named DLL. The decrypted RAT employs position-based string substitution encryption and enumerates the running process list for 40+ security solutions (Kaspersky, Avast, McAfee, BitDefender, MalwareBytes, and others).

The RAT maintains a UDP heartbeat to port 57441 reporting detected security solutions, system startup time, input idle time, architecture, IP and username. Default C2 endpoints are dynamic-DNS domains: asper1.freeddns.org (early builds) and Winst0.kozow.com (recent builds), with a zh-CN locale fallback to country1.ignorelist.com (resolving to 127.0.0.1 or 186.158.223.35). An 'extended mode' switches to TCP port 3747 using a simple ASCII-position substitution cipher, with commands separated by the first space character. The command set provides full remote control: system control (KILL REBOOT / POWER / SELF), screen capture (SCREEN/SCREEN9 saved to ~wra1269.tmp), extensive file operations (DELETE, REN, MAKDIR, ZIPFILE/ZIPFOLDER, TAR, GETFILEDATE/SETFILEDATE timestomping, DWLOAD/UPLOAD), reconnaissance (USER, IDLE, DRIVES, FOLDEX, LFILES, OSVER), and interactive control (RUNHID/RUN, RUNDOS, MOUSE/keyboard control).

Kaspersky telemetry shows hundreds of infections, with primary victim geography in Russia, Brazil, Germany and Vietnam. The campaign is not attributed to a named actor, but Spanish-language variable names, function names and comments in the delivery scripts and website code support a medium-confidence assessment of a Spanish-speaking developer.

## MITRE ATT&CK

- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1559 Inter-Process Communication
- T1053 Scheduled Task/Job
- T1546 Event Triggered Execution
- T1574 Hijack Execution Flow
- T1112 Modify Registry
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1197 BITS Jobs
- T1070 Indicator Removal
- T1518 Software Discovery
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1124 System Time Discovery
- T1113 Screen Capture
- T1560 Archive Collected Data
- T1056 Input Capture
- T1071 Application Layer Protocol
- T1095 Non-Application Layer Protocol
- T1571 Non-Standard Port
- T1573 Encrypted Channel
- T1568 Dynamic Resolution
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1529 System Shutdown/Reboot

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Argamal Delivery — Trojanized FFmpeg DLL Sideload & natives2_blob Script Executor** (`TL-2026-0670-SPL-001`)

Detects the Argamal initial-access trigger: a trojanized FFmpeg DLL bundled with a RenPy/RPG-Maker game imports DllGetClassObject from the malicious blob natives2_blob.bin (or the alternative libpython64.dat dropped in game library dirs), launching the Stage1 PowerShell chain. Targets Sysmon image-load events for these delivery artifacts loaded from user-writable game directories.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1574.001, T1204.002, T1059.001, T1497.001
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7
(ImageLoaded="*\\natives2_blob.bin" OR ImageLoaded="*\\libpython64.dat" OR (ImageLoaded="*\\ffmpeg*.dll" AND (ImageLoaded="*\\AppData\\Local\\*" OR ImageLoaded="*\\Games\\*" OR ImageLoaded="*\\renpy\\*")))
| eval delivery_artifact=case(like(ImageLoaded,"%natives2_blob.bin"),"natives2_blob", like(ImageLoaded,"%libpython64.dat"),"libpython64", true(),"trojanized_ffmpeg_dll")
| stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as loaded_modules by host, Image, delivery_artifact
| where Image LIKE "%python%" OR Image LIKE "%game%" OR Image LIKE "%nw.exe" OR Image LIKE "%\\AppData\\Local\\%" OR delivery_artifact!="trojanized_ffmpeg_dll"
| convert ctime(firstTime) ctime(lastTime)
| table firstTime lastTime host Image delivery_artifact loaded_modules
```

### Microsoft KQL

```kql
DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FileName in~ ("natives2_blob.bin","libpython64.dat") or (FileName startswith "ffmpeg" and FileName endswith ".dll" and FolderPath has_any ("AppData\\Local","renpy","Games"))
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, FileName, FolderPath, SHA1
| order by Timestamp desc
```

### Sigma

```yaml
title: Argamal Trojanized FFmpeg DLL Sideload and natives2_blob Script Executor
id: 7c1f0a4e-2d3b-4e91-9a10-0670aa000101
status: experimental
description: Detects Argamal RAT delivery via a trojanized FFmpeg DLL loading the malicious natives2_blob.bin / libpython64.dat blob that launches the Stage1 PowerShell chain.
references:
    - https://securelist.com/argamal-rat-distributed-with-hentai-games/119999/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/03
tags:
    - attack.execution
    - attack.t1204.002
    - attack.persistence
    - attack.t1574.001
    - attack.defense_evasion
    - attack.t1497.001
logsource:
    product: windows
    category: image_load
detection:
    blob_load:
        ImageLoaded|endswith:
            - '\natives2_blob.bin'
            - '\libpython64.dat'
    ffmpeg_sideload:
        ImageLoaded|contains: '\ffmpeg'
        ImageLoaded|endswith: '.dll'
        ImageLoaded|contains:
            - '\AppData\Local\'
            - '\renpy\'
            - '\Games\'
    condition: blob_load or ffmpeg_sideload
falsepositives:
    - Legitimate media applications shipping their own ffmpeg.dll in user-writable directories
level: high
```

**Known false positives:**

- Legitimate media/game applications that ship a private ffmpeg.dll in AppData or game directories
- Security tooling that loads modules with similar names during analysis

**Tuning notes:** Allowlist known-good ffmpeg.dll SHA1 hashes used by legitimately installed games/media players. The natives2_blob.bin and libpython64.dat names are high-fidelity Argamal indicators and rarely require tuning. Pair with Stage1 PowerShell process-creation alerts for higher confidence.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Argamal Stage1 — Sandbox/AV Discovery Sweep & Base64 PowerShell Execution (locked: unlock with TL Creds)
- Argamal Persistence — bitsadmin GitHub Payload Retrieval & 3-Day Delayed Scheduled Task (locked: unlock with TL Creds)
- Argamal C2 — Dynamic-DNS Domain Resolution & Known C2 Infrastructure (locked: unlock with TL Creds)
- Argamal Stage1->Stage2 — Base64 PowerShell Stored in MI_V/MI_V2 Environment Variables (locked: unlock with TL Creds)
- Argamal Encrypted Payload Artifacts — [indicator] / [indicator] in AppData Local (locked: unlock with TL Creds)
- Argamal RAT Operations — Screen Capture ([indicator]), Timestomping & Archive Collection (locked: unlock with TL Creds)
- Argamal Persistence — COM Hijacking of WindowsColorSystem Calibration CLSID (locked: unlock with TL Creds)
- Argamal C2 — Non-Standard UDP/57441 Heartbeat & TCP/3747 Extended Mode (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 41)

Defanged, TLP:CLEAR.

- IP address: `186.158.223[.]35`
- Domain: `asper1[.]freeddns[.]org`
- URL: `hxxps://github[.]com/gmz159/u`

Full set of 41 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Argamal: Malware hidden in hentai games (Securelist / Kaspersky GReAT)](https://securelist.com/argamal-rat-distributed-with-hentai-games/119999/)
- [MITRE ATT&CK T1546.015 — Component Object Model Hijacking](https://attack.mitre.org/techniques/T1546/015/)
- [MITRE ATT&CK T1197 — BITS Jobs](https://attack.mitre.org/techniques/T1197/)
- [MITRE ATT&CK T1053.005 — Scheduled Task](https://attack.mitre.org/techniques/T1053/005/)
- [MITRE ATT&CK T1497 — Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497/)
- [MITRE ATT&CK T1568 — Dynamic Resolution (Dynamic DNS C2)](https://attack.mitre.org/techniques/T1568/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0670