Argamal: Malware hidden in hentai games
A new malware campaign, dubbed "Argamal," is targeting users of hentai games. The campaign involves injecting a malicious implant into legitimate game files, leveraging COM hijacking to establish persistence and achieve full system compromise. The malware utilizes techniques like DLL replacement and scheduled tasks to maintain control, and employs various encryption methods to obfuscate its actions. This campaign highlights the risks associated with distributing software from untrusted sources, particularly within niche gaming communities.
The Securelist team discovered a malware campaign, named Argamal, targeting players of "hentai" games in April 2026. The malware operates by installing a previously unknown malicious implant within the game files themselves. Once executed, the implant downloads and runs a Trojan, granting attackers remote control over the infected system. The campaign leverages the distribution of trojanized games via websites and torrent trackers, including PixelDrain and AniRena. The malware’s persistence mechanism relies on COM hijacking, replacing the InprocServer32 DLL to execute at startup upon user login. This allows for continuous operation and control.
The Argamal malware employs a multi-stage approach. Initially, a Base64-encoded PowerShell script (Stage1) performs checks for controlled environments, establishing persistence if the environment is not detected. Subsequently, Stage2 downloads and decrypts a payload (zaesdl.dat) from GitHub, utilizing AES-CBC encryption with a dynamically generated key. The decrypted payload is then installed as an InprocServer32 COM object, further solidifying the malware's presence and control. The malware also utilizes string encryption with a complex substitution cipher.
This campaign underscores the vulnerability of users downloading software from unofficial sources, particularly within communities focused on niche genres like hentai games. The use of techniques like COM hijacking and dynamic key generation demonstrates the sophistication of the threat actors involved. The reliance on GitHub for payload delivery adds another layer of complexity to the attack chain.