Kaspersky Details "Argamal" — a Stealthy New RAT Hiding in Pirated Games via COM Hijacking and bitsadmin
Kaspersky's Securelist team has documented a previously unreported remote access trojan, dubbed Argamal, that hides inside trojanized pirated games and survives reboots through COM hijacking — abusing a legitimate Windows calibration component to relaunch at every logon. Researcher Mikhail Reznichenko reports the campaign surfaced in April 2026 after telemetry flagged suspicious DLLs spawned by adult games built on the RenPy and RPG Maker MV engines, with implant traces in samples dating back to at least 2024.
The lure is a niche gaming community, but the tradecraft is the story: Argamal chains DLL side-loading, sandbox evasion, living-off-the-land binaries, and dynamic C2 rotation into a quiet, persistent foothold.
Delivery and persistence
Per Securelist, infected game archives are seeded through dedicated catalogue sites that redirect to the file-transfer service PixelDrain, and through torrent trackers such as AniRena. Each archive ships a working game alongside a modified FFmpeg DLL that side-loads a payload from a file named natives2_blob.bin.
The loader runs a Base64-encoded PowerShell stage that checks for sandboxing artifacts (Sandboxie, Procmon64) before establishing persistence via COM hijacking — replacing the InprocServer32 entry for the Windows Color System Calibration Loader CLSID so the malware launches at every user logon. A second PowerShell stage then pulls an AES-CBC encrypted payload from GitHub using bitsadmin.exe, and cleans up its earlier registry artifacts and scheduled task to minimize forensic footprint.
Command and control
The RAT beacons to its C2 with UDP heartbeats on port 57441, reporting detected security products, uptime, locale, idle time, IP address, and username. Operator commands include arbitrary file execution via ShellExecuteW and WinExec, file deletion, dynamic C2 rotation, and an extended mode that switches communications to TCP port 3747 using a substitution cipher.
Notably, hosts with a default locale of zh-CN are redirected to separate infrastructure that initially resolved to localhost (127.0.0.1) before flipping to the live operator IP in late April — suggesting either staged deployment or deliberate handling of Chinese-locale victims.
Indicators of Compromise
Kaspersky lists the following (defanged — re-arm only in controlled environments):
Network:
asper1[.]freeddns[.]org(earlier samples)Winst0[.]kozow[.]com(latest builds)country1[.]ignorelist[.]com(zh-CN redirect)- All resolving to
186[.]158[.]223[.]35 - UDP port
57441(heartbeat); TCP port3747(extended mode)
File hash:
- Modified FFmpeg DLL — SHA1
42add9475e67a1ccc6a6af94b5475d3defc01b85
Attacker-controlled GitHub distribution:
hxxps://github[.]com/gmz159/uhxxps://github[.]com/DnyP/fileshxxps://github[.]com/mgzv/p
Assessment
We assess with moderate confidence that Argamal is the work of a financially or access-oriented criminal operator rather than a state-aligned cluster — based on the consumer-focused lure, broad and opportunistic targeting, reliance on public file-sharing services, and the absence of espionage-specific tooling described by Kaspersky.
The choice of a pirated-game community as a delivery channel mirrors a wider trend of operators exploiting ecosystems where users are already conditioned to disable defenses and ignore reputation prompts. The pattern is durable because the victim does the hardest part of the attacker's job — turning off protection — voluntarily.
The highest-fidelity hunting leads are behavioral: execution of bitsadmin.exe as a child of a game launcher, creation of CLSIDs under HKCU\SOFTWARE\Classes\CLSID for unfamiliar GUIDs, and UDP traffic to port 57441 toward the indicators above. Argamal is not currently mapped to a tracked actor in IntelFusions' Atomic Fusion taxonomy.
Source: Kaspersky Securelist — New Argamal RAT targets hentai gamers. This briefing is provided by IntelFusions for informational and defensive purposes only. Analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named.