asper1[.]freeddns[.]org

In April 2026, we discovered a new malware campaign targeting players of “hentai” games. Once launched, the infected games install a previously unknown malicious implant on the user’s machine. After a few days, the implant downloads and executes a Trojan, resulting in full system compromise and broad remote control capabilities for the attackers. We dubbed this malware family “Argamal”. The malware uses COM hijacking to persist on the victim’s machine, replacing the InprocServer32 entry for Windows Color System Calibration Loader DLL. This task is triggered when the user logs in, effectively allowing the malware to run at startup. Kaspersky solutions detect this threat as Trojan.Win32.Termixia.*, Trojan.Win32.Agent.*, HEUR:Trojan.Win32.Argamal.gen and HEUR:Trojan-Downloader.Win32.Argamal.gen. Technical details Background In April, as part of our ongoing monitoring of telemetry data, we found some suspicious DLLs. Further analysis revealed that various versions of these DLLs have existed since at least 2024. The DLLs were spawned by different games written using various game engines and programming languages, including RenPy (Python) and RPG Maker MV (JavaScript), among others. However, they all had one thing in common: they were all hentai games. We searched for the distribution sources and found a number of websites hosting game screenshots and download links. These links redirected users to PixelDrain, a free file transfer service. In addition to these websites, the trojanized games have also been distributed via different torrent trackers, including AniRena. Delivery Both the dedicated websites and torrents delivered an archive containing the infected game. This archive contained fully functional, legitimate game files, as well as a modified FFmpeg DLL (SHA1: 42add9475e67a1ccc6a6af94b5475d3defc01b85), that imported the DllGetClassObject function from a file called natives2_blob.bin. Since the game needs ffmpeg.dll to run properly, the library loads as soon as the user starts the game. Script executor The natives2_blob.bin (SHA1: edce72f59e4c1d136cd1946af70d334c19df858d) file is a DLL that executes a Base64-encoded PowerShell script when loaded. This PowerShell script, which we’ll call Stage1, performs basic checks for controlled environments. For example, it checks for the Sandboxie folder in Program Files and Procmon64 in the process list. If all the checks indicate that the process is not running in a controlled environment, it proceeds to establish persistence. Stage1 sets the MI_V environment variable (and also MI_V2 in the new versions of malware) for the current user to another Base64-encoded PowerShell script, which we’ll call Stage2. After that, it sets the InprocServer32 registry key at HKCU\SOFTWARE\Classes\CLSID\{722D0F89-B69C-4700-AE8C-4A44350E4876} to a random DLL file name in a random subdirectory of %USER%\AppData\Local, as well as the ShellFolder subkey to another random DLL file name in the same location. Stage1 also creates a scheduled task that will execute three days later. This task executes Stage2 and runs once. Stage2 is a payload downloader script. It takes previously generated DLL filenames from the registry and downloads an encrypted payload called zaesdl.dat from GitHub using bitsadmin.exe. The downloaded payload is saved in the settings.dat file in the randomly chosen subdirectory of %USER%\AppData\Local. Stage2 decrypts it using AES-CBC with the key zbcd1j9234r670eh and an IV equal to the key. The decrypted payload is then saved in the DLL file specified in the ShellFolder registry subkey. The decrypted payload is set as InprocServer32 at HKCU\SOFTWARE\Classes\CLSID\{B210D694-C8DF-490D-9576-9E20CDBC20BD}, which is a COM object used by the \Microsoft\Windows\WindowsColorSystem\Calibration Loader scheduled task. This task runs every time a user logs in, allowing the malware to run during every user session. Before quitting, Stage2 also removes the changes made under the HKCU\SOFTWARE\Classes\CLSID\{722D0F89-B69C-4700-AE8C-4A44350E4876} registry key, unsets the MI_V environment variable (and MI_V2 in newer versions), and removes the scheduled task that launched Stage2. Malicious agent Early payload versions decrypted themselves using the 0xB0C1D4E9 rolling XOR key, where the decryption key for the i + 1 block is the encrypted content of the i block (each encrypted block being four bytes long). The most recent agent versions don’t do that. The samples we found had string encryption; they use a simple substitution with a key that corresponds position-by-position to the following alphabet: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789@#$./: *&~. The decryption process involves finding the position of each symbol of the encrypted strings in the key, and replacing it with the symbol that occupies the same position in the alphabet. During our investigation, we found the following keys were used: 17htUno/I3L&fK2H#yapE@b5NqZ$Q4xmeF.s96uB>jkdWCPvAgD*XwO:iR~TMrV0YGl8z jdkWCPvAgD*XwO:iR~TMrV0YGl8z jkdWCvPAgD*XwO:iR~TrMV0YGl8z : deletes specified file DELDIR : deletes specified directory REN # : moves specified file MAKDIR : creates directory ZIPFILE /ZIPFOLDER : compresses specified file/folder into a.zip archive TAR /TAR2 : compresses specified file/folder into a .tar archive GETFILEDATE : sends file’s last modification date SETFILEDATE : sets file’s last modification date GETFILEACC : sends file’s last access date DWLOAD : sends file to the C2 UPLOAD # : uploads file to the specified C2 server Reconnaissance USER : sends username KALIVE : sends run cycle counter IDLE : sends number of seconds passed since last input activity DRIVES : sends information about mounted drives FOLDEX : sends full path to a directory of the specified type: – type = 0x63 : temporary directory – type = 0x64 : \Google\Chrome\User Data\Default\ in AppData\Local folder – type = 0x65 : \Downloads\ in user home directory – type = 0x66 : \Microsoft\Excel\XLSTART\ in AppData folder – type = 0x67 : AppData folder LFILES : lists and sends paths to all files in the directory OSVER : sends information about user, hostname, OS architecture and version COMPILERDATE : sends constant hardcoded in the RAT, e.g., 25.10.2025 Generic control DSOCKE : recreates TCP keep-alive socket QUIT : notifies the C2 about quitting, closes the socket and stops the process RUNHID /RUN : runs specified command insideShellExecuteW RUNDOS : runs specified command inside CreateProcessW RUNTASK : creates, runs and deletes task that executes specified command SKEY : presses specified key MOUSE FREEZE : freezes mouse movement MOUSE : clicks the specified mouse button or sets the cursor position to the specified coordinates Other delivery methods During our research, we also observed other delivery methods for the RAT. Instead of patching FFmpeg and downloading the payload from GitHub, the attackers included the main payload as libpython64.dat or another file with a similar name in the lib\py3-windows-x86_64 directory of the game. This .dat file was loaded by one of the libraries used in the game, which was patched for this purpose. In another case, the threat actor posted their malicious DLL file (payload downloader) on a gaming forum, disguising it as a cheat. Infrastructure Our research revealed the following infrastructure was used in this attack. Victims According to our telemetry, hundreds of individuals were infected with this malware. The majority of the victims were located in Russia, Brazil, Germany and Vietnam. Attribution Based on the language of the comments in the code, infrastructure data and other facts we assess with medium confidence that the developer of the downloader chain speaks Spanish. The actor behind this attack uses Spanish in variable names and comments. For example, the Base64-decoded delivery script contains the following lines: In addition, the JavaScript code from the website distributing infected games contains variable names, function names and comments in Spanish: Notably, the malware payloads used in this attack had previously chosen 127.0.0.1 as their C2 server when the victim’s default locale is set to “zh-CN”, thus not targeting Chinese users. This may indicate that the attacker is associated with a Chinese-speaking threat actor or uses payloads developed by a Chinese-speaking threat actor. However, we still believe it’s unlikely that the developer of these delivery chains is Chinese-speaking. Conclusions The Argamal Trojan is a new RAT targeting individuals who seek adult games. During our analysis, we observed a steady stream of updates to the payload, including the addition of new features and fixes for various bugs, as well as changes to the infrastructure. This leads us to believe that the threat actor behind this malware will continue to develop and enhance it. The campaign’s goal is likely data and credential theft; however, the RAT enables the attacker to take full control of the device and execute any malicious activity they want. Creating malware in today’s development landscape has become significantly easier thanks to the wide availability of detailed guides, tooling, and automation resources. As a result, it is crucial not only to detect known malware but also to identify new and evolving threats as they emerge. Kaspersky solutions prevented the malicious activity in the earliest stages of the attack. The solutions help ensure device security by identifying not only known threats but also the behavior of the software and its actions, providing comprehensive protection against malware. Indicators of Compromise Additional information about this activity, including indicators of compromise, is available to customers of the Kaspersky Intelligence Reporting Service. If you are interested, please contact [email protected]. Trojan downloaders: 9803604ec45f31f9ef75bcca1e1310d8ac1fc3a6 edce72f59e4c1d136cd1946af70d334c19df858d 02819d200d1424882af81cb504b3e8614b32397a Domains and IPs asper1[.]freeddns[.]org Winst0[.]kozow[.]com Country1[.]ignorelist[.]com 186[.]158.223.35 GitHub repositories used in the campaign hxxps://github[.]com/gmz159/u hxxps://github[.]com/DnyP/files hxxps://github[.]com/mgzv/p