Argamal RAT & Smishing-as-a-Service: Multi-Vector Credential Theft Campaigns — OTX Pulse Analysis

---
title: Potential Argamal/Termixia COM Hijacking via MSCMS.dll
id: aa1b2c3d-e4f5-6a7b-8c9d-0e1f2a3b4c5d
description: Detects COM hijacking attempts targeting Windows Color System Calibration Loader (mscms.dll), a persistence mechanism used by Argamal malware
status: experimental
date: 2026/07/04
author: Security Arsenal Threat Intelligence
references:
    - https://securelist.com/argamal-rat-distributed-with-hentai-games/119999/
tags:
    - attack.persistence
    - attack.t1546.015
logsource:
    product: windows
    registry:
        - add
        - modify
detection:
    selection:
        TargetObject|contains:
            - 'HKCU\\Software\\Classes\\CLSID'
            - 'HKLM\\Software\\Classes\\CLSID'
        TargetObject|contains:
            - '{7C857801-7381-11CF-884D-00AA004B2E24}'  # MSCMS CLSID
            - '{1D39B4C1-9D02-4F76-96D3-4A2D3CF987B4}'  # Alternative Color System CLSID
        Details|contains:
            - '.dll'
            - '.exe'
        Details|notcontains:
            - 'C:\\Windows\\System32\\mscms.dll'
            - 'C:\\Windows\\SysWOW64\\mscms.dll'
    condition: selection
falsepositives:
    - Legitimate software installation that modifies color calibration settings
level: high

---
title: Suspicious PowerShell Execution with Gaming-Related Arguments
id: bb2c3d4e-f5a6-7b8c-9d0e-1f2a3b4c5d6e
description: Detects PowerShell execution patterns consistent with Argamal delivery and gaming-related malware campaigns
status: experimental
date: 2026/07/04
author: Security Arsenal Threat Intelligence
references:
    - https://securelist.com/argamal-rat-distributed-with-hentai-games/119999/
tags:
    - attack.execution
    - attack.t1059.001
    - attack.defense_evasion
    - attack.t1027
logsource:
    product: windows
    service: security
detection:
    selection_powershell:
        EventID: 4688
        NewProcessName|endswith:
            - '\\powershell.exe'
            - '\\pwsh.exe'
    selection_suspicious_args:
        CommandLine|contains:
            - 'Invoke-Expression'
            - 'IEX'
            - 'DownloadString'
            - 'FromBase64String'
    selection_gaming_keywords:
        CommandLine|contains:
            - 'hentai'
            - 'game'
            - 'mod'
            - 'patch'
            - 'adult'
            - 'pixeldrain'
    condition: all of selection_*
falsepositives:
    - Legitimate gaming software installation
    - System administrators using PowerShell for legitimate maintenance
level: medium

---
title: Network Connections to Known Argamal C2 Infrastructure
id: cc3d4e5f-a6b7-8c9d-0e1f-2a3b4c5d6e7f
description: Detects network connections to known C2 infrastructure associated with Argamal/Termixia campaigns
status: experimental
date: 2026/07/04
author: Security Arsenal Threat Intelligence
references:
    - https://securelist.com/argamal-rat-distributed-with-hentai-games/119999/
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 3
        DestinationHostname|contains:
            - 'freeddns.org'
            - 'ddns.net'
            - 'no-ip.org'
        DestinationHostname|contains:
            - 'asper1'
        DestinationPort:
            - 443
            - 80
            - 8080
    condition: selection
falsepositives:
    - Legitimate use of dynamic DNS services
    - False positives from personal devices on corporate network
level: high


kql
// KQL for Microsoft Sentinel - Hunt for Argamal/Termixia activity
// Process creation events with PowerShell suspicious arguments
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessVersionInfoProductName contains "PowerShell" or ProcessVersionInfoOriginalFileName contains "powershell"
| where ProcessCommandLine has_any ("Invoke-Expression", "IEX", "DownloadString", "FromBase64String", "WebRequest")
| where ProcessCommandLine has_any ("hentai", "game", "mod", "patch", "adult", "pixeldrain")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, FolderPath, SHA256
| order by Timestamp desc

// Network connections to suspicious C2 infrastructure
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl has_any ("freeddns.org", "ddns.net", "no-ip.org") or RemoteIP == "45.11.229.230"
| where InitiatingProcessFileName !in ("chrome.exe", "firefox.exe", "msedge.exe", "opera.exe")
| project Timestamp, DeviceName, AccountName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

// Registry modifications for COM hijacking
DeviceRegistryEvents
| where Timestamp > ago(30d)
| where RegistryKey contains "CLSID" and (RegistryKey contains "7C857801-7381-11CF-884D-00AA004B2E24" or RegistryKey contains "InprocServer32")
| where RegistryKey !contains "C:\\Windows\\System32\\mscms.dll"
| project Timestamp, DeviceName, AccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName
| order by Timestamp desc


powershell
# PowerShell hunt script for Argamal/Termixia indicators
# Run with elevated privileges

# Initialize results array
$results = @()

# 1. Check for COM hijacking of MSCMS.dll
Write-Host "Checking for COM hijacking of MSCMS.dll..." -ForegroundColor Cyan

$mscmsCLSID = "{7C857801-7381-11CF-884D-00AA004B2E24}"
$inprocPaths = @(
    "HKCU:\Software\Classes\CLSID\$mscmsCLSID\InprocServer32",
    "HKLM:\Software\Classes\CLSID\$mscmsCLSID\InprocServer32",
    "HKCU:\Software\Wow6432Node\Classes\CLSID\$mscmsCLSID\InprocServer32",
    "HKLM:\Software\Wow6432Node\Classes\CLSID\$mscmsCLSID\InprocServer32"
)

foreach ($path in $inprocPaths) {
    if (Test-Path $path) {
        $default = (Get-ItemProperty -Path $path -ErrorAction SilentlyContinue).'(default)'
        if ($default -and $default -notmatch "C:\\Windows\\(System32|SysWOW64)\\mscms.dll") {
            $results += [PSCustomObject]@{
                CheckType = "Registry COM Hijack"
                Path = $path
                Value = $default
                Status = "MALICIOUS"
                Timestamp = Get-Date
            }
            Write-Host "[!] Suspicious DLL path found: $default" -ForegroundColor Red
        }
    }
}

# 2. Check for known Argamal/Termixia file hashes
Write-Host "Scanning for known Argamal file hashes..." -ForegroundColor Cyan

$knownHashes = @(
    "02819d200d1424882af81cb504b3e8614b32397a",
    "1405a3c5e0aeb08012484134e16cdec4ab29b4a4",
    "17f8f8f34dfa737f36182fed7ff9e9814a114058",
    "2423a5bf0fa7cb9ec09211630a5488629499691b",
    "29f1d346a6e71774c7dad25b90f446b2974393df",
    "42add9475e67a1ccc6a6af94b5475d3defc01b85"
)

$drives = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root
foreach ($drive in $drives) {
    try {
        $files = Get-ChildItem -Path $drive -Recurse -Include *.exe,*.dll -ErrorAction SilentlyContinue
        foreach ($file in $files) {
            $hash = (Get-FileHash -Path $file.FullName -Algorithm SHA1 -ErrorAction SilentlyContinue).Hash
            if ($hash -in $knownHashes) {
                $results += [PSCustomObject]@{
                    CheckType = "Malicious File Hash"
                    Path = $file.FullName
                    Value = $hash
                    Status = "MALICIOUS"
                    Timestamp = Get-Date
                }
                Write-Host "[!] Known malicious file found: $($file.FullName)" -ForegroundColor Red
            }
        }
    } catch {
        # Ignore access denied errors
    }
}

# 3. Check network connections to suspicious C2 infrastructure
Write-Host "Checking network connections to suspicious C2 infrastructure..." -ForegroundColor Cyan

$suspiciousHosts = @(
    "asper1.freeddns.org",
    "45.11.229.230"
)

$connections = Get-NetTCPConnection -ErrorAction SilentlyContinue | 
    Where-Object { $_.State -eq "Established" } |
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess

foreach ($conn in $connections) {
    try {
        $remoteHost = [System.Net.Dns]::GetHostEntry($conn.RemoteAddress).HostName
        if ($suspiciousHosts | Where-Object { $remoteHost -like "*$_*" }) {
            $process = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
            $results += [PSCustomObject]@{
                CheckType = "Suspicious Network Connection"
                Path = $process.Path
                Value = "$remoteHost ($($conn.RemoteAddress))"
                Status = "MALICIOUS"
                Timestamp = Get-Date
            }
            Write-Host "[!] Suspicious connection found: $remoteHost" -ForegroundColor Red
        }
    } catch {
        # DNS resolution failed
    }
}

# 4. Check for suspicious scheduled tasks
Write-Host "Checking for suspicious scheduled tasks..." -ForegroundColor Cyan

$suspiciousTasks = Get-ScheduledTask -ErrorAction SilentlyContinue | 
    Where-Object { $_.Actions.Execute -like "*powershell*" -or $_.Actions.Execute -like "*cmd*" }

foreach ($task in $suspiciousTasks) {
    if ($task.Actions.Arguments -match "hentai|game|mod|adult|pixeldrain|freeddns|ddns") {
        $results += [PSCustomObject]@{
            CheckType = "Suspicious Scheduled Task"
            Path = $task.TaskPath
            Value = $task.Actions.Arguments
            Status = "SUSPICIOUS"
            Timestamp = Get-Date
        }
        Write-Host "[!] Suspicious scheduled task found: $($task.TaskName)" -ForegroundColor Yellow
    }
}

# Output results
Write-Host "`n=== SCAN RESULTS ===" -ForegroundColor Cyan
$results | Format-Table -AutoSize

if ($results.Count -eq 0) {
    Write-Host "No indicators found." -ForegroundColor Green
} else {
    Write-Host "`nScan complete. $($results.Count) indicators found." -ForegroundColor Yellow
}