Argamal: Malware hidden in hentai games

What Happened

Cybersecurity researchers have discovered a new malware called Argamal hidden inside downloadable adult games. When a user plays the infected game, it secretly installs a program that gives attackers complete control over the victim's computer, allowing them to steal files, take screenshots, and monitor activity. This matters because the malware is designed to evade detection and can lead to severe privacy breaches and data theft. Users should avoid downloading games from untrusted torrents or file-sharing sites and ensure their antivirus software is up to date.

Key Takeaways

• Argamal is a newly discovered RAT distributed via trojanized adult games on torrents and file-sharing sites.
• The infection chain utilizes DLL sideloading via a modified ffmpeg.dll to execute a PowerShell downloader.
• Persistence is achieved through COM hijacking of the Windows Color System Calibration Loader, allowing the malware to run at startup.
• The RAT communicates via UDP for heartbeats and TCP for extended control, featuring custom substitution ciphers.
• Code comments and variable names suggest the downloader chain was developed by a Spanish-speaking threat actor.

Affected Systems

• Windows

Attack Chain

The attack begins when a user downloads and executes a trojanized game containing a modified ffmpeg.dll. This DLL sideloads natives2_blob.bin, which executes a Base64-encoded PowerShell script (Stage 1) to establish initial registry modifications and a scheduled task. The scheduled task triggers Stage 2, which downloads an encrypted payload from GitHub using bitsadmin.exe, decrypts it, and establishes persistence via COM hijacking of the Windows Color System Calibration Loader. Finally, the Argamal RAT executes, communicating with its C2 server via UDP and TCP to receive commands for system control, surveillance, and data exfiltration.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

The article does not provide specific detection rules (YARA, Sigma, etc.) but mentions that Kaspersky solutions detect the threat under various Trojan.Win32 heuristics.

Detection Engineering Assessment

EDR Visibility: High — EDR solutions can easily monitor DLL loads (ffmpeg.dll), PowerShell execution with encoded commands, bitsadmin.exe network connections, and registry modifications targeting COM objects. Network Visibility: Medium — Network visibility is moderate because C2 traffic uses custom UDP heartbeats and TCP substitution ciphers, which may not match standard HTTP/HTTPS signatures, though connections to raw IPs or dynamic DNS domains can be spotted. Detection Difficulty: Moderate — While the initial DLL sideloading might blend in with game execution, the subsequent use of bitsadmin.exe, encoded PowerShell, and COM hijacking of a specific Windows Color System CLSID are strong, detectable behavioral signals.

Required Log Sources

• Process Creation (Event ID 4688 / Sysmon Event ID 1)
• Registry Events (Sysmon Event IDs 12, 13, 14)
• Network Connections (Sysmon Event ID 3)
• File Creation (Sysmon Event ID 11)

Hunting Hypotheses

Control Gaps

• Lack of application control allowing unsigned/modified DLLs to load
• Permissive outbound network rules allowing bitsadmin.exe to reach GitHub

Key Behavioral Indicators

• bitsadmin.exe downloading from github.com
• Modification of CLSID {B210D694-C8DF-490D-9576-9E20CDBC20BD}
• Creation of ~wra1269.tmp files
• Environment variables MI_V or MI_V2 being set with Base64 content

False Positive Assessment

• Low

Recommendations

Immediate Mitigation

• Verify against your organization's incident response runbook and team escalation paths before acting.
• Consider blocking the identified C2 domains and IP addresses at the perimeter firewall or DNS sinkhole.
• If applicable, search endpoint telemetry for the presence of the identified SHA1 hashes or the specific COM hijacking registry keys.

Infrastructure Hardening

• Evaluate whether application control (e.g., AppLocker or WDAC) can be implemented to prevent the execution of untrusted binaries and DLLs from user directories.
• Consider restricting the use of bitsadmin.exe and other LOLBins for users who do not require them.

User Protection

• If your EDR supports it, ensure behavioral rules are enabled to detect COM hijacking and suspicious PowerShell execution.
• Consider enforcing restrictions on downloading and executing files from unverified torrent trackers or file-sharing sites.

Security Awareness

• Consider rolling into existing awareness programs the risks of downloading pirated software, games, or cheats from unofficial sources.

MITRE ATT&CK Mapping

• T1574.002 - DLL Side-Loading
• T1546.015 - Component Object Model Hijacking
• T1059.001 - PowerShell
• T1053.005 - Scheduled Task
• T1140 - Deobfuscate/Decode Files or Information
• T1105 - Ingress Tool Transfer
• T1518.001 - Security Software Discovery
• T1113 - Screen Capture

Additional IOCs

• Ips:
  • 181[.]116[.]218[.]56 - IP address resolving to asper1.freeddns.org
• Domains:
  • country1[.]ignorelist[.]com - Argamal RAT C2 server used when victim locale is set to zh-CN
• Urls:
  • hxxps://github[.]com/DnyP/files - GitHub repository used to host Argamal encrypted payloads
  • hxxps://github[.]com/mgzv/p - GitHub repository used to host Argamal encrypted payloads
• File Hashes:
  • 76253fb55aed707440e808ea78e7101318436b1c (SHA1) - Argamal RAT payload
  • 1405a3c5e0aeb08012484134e16cdec4ab29b4a4 (SHA1) - Argamal RAT payload
  • 535f4337f261b6da20a3c614eb13270bed2d533a (SHA1) - Argamal RAT payload
  • d2cb0d7a9ad2b5d4ea7c2da8aec62beb37cf36d6 (SHA1) - Argamal RAT payload
  • e05f1767c2a337910ed75e90288838d6d0541164 (SHA1) - Argamal RAT payload
  • dad26f61da7b8bccc78364411812be74c025b475 (SHA1) - Argamal RAT payload
  • 29f1d346a6e71774c7dad25b90f446b2974393df (SHA1) - Argamal RAT payload
  • e815a9b418d09c2d4bcd074c2c0bc21406eeb22f (SHA1) - Argamal RAT payload
  • 17f8f8f34dfa737f36182fed7ff9e9814a114058 (SHA1) - Argamal RAT payload
  • 954722b0c9c678b1313d1f8b204e102842dc5889 (SHA1) - Argamal RAT payload
  • 69331cfdac792dc79240e6a6bb6e803eabd70beb (SHA1) - Argamal RAT payload
  • 901cfa97b1baaf908fd4a02bb52d970f576c4193 (SHA1) - Argamal RAT payload
  • 5f1f3689bcf23de1b280b5f35712946da0f7978f (SHA1) - Argamal RAT payload
  • c2d9d48b3b10bd58cdf5df9463e3ffcd60533ff3 (SHA1) - Argamal RAT payload
  • 2423a5bf0fa7cb9ec09211630a5488629499691b (SHA1) - Argamal RAT payload
  • ae4601a19d28332a3ec6ac31b385cdf53be53450 (SHA1) - Argamal RAT payload
  • 9803604ec45f31f9ef75bcca1e1310d8ac1fc3a6 (SHA1) - Trojan downloader
  • 02819d200d1424882af81cb504b3e8614b32397a (SHA1) - Trojan downloader
• Registry Keys:
  • HKCU\SOFTWARE\Classes\CLSID\{722D0F89-B69C-4700-AE8C-4A44350E4876}\InprocServer32 - Temporary registry key set by Stage 1 to point to a random DLL
  • HKCU\SOFTWARE\Classes\CLSID\{722D0F89-B69C-4700-AE8C-4A44350E4876}\ShellFolder - Temporary registry key set by Stage 1 to point to a random DLL
• File Paths:
  • zaesdl.dat - Encrypted payload downloaded from GitHub
  • settings.dat - Filename used to save the encrypted payload in a random AppData\Local subdirectory
  • ~wra1269.tmp - Temporary file used by the RAT to save screenshots before exfiltration
  • libpython64.dat - Alternative payload filename observed in the lib\py3-windows-x86_64 directory
• Command Lines:
  • Purpose: Download encrypted payload from GitHub | Tools: bitsadmin.exe | Stage: Execution / Ingress Tool Transfer | bitsadmin.exe
  • Purpose: Execute Base64-encoded PowerShell script | Tools: powershell.exe | Stage: Execution | powershell.exe -EncodedCommand
  • Purpose: Check for running security solutions | Tools: tasklist.exe | Stage: Discovery | tasklist