Argamal RAT, RemusStealer & ClickFix: Multi-Platform Credential Theft Campaigns

title: Potential Argamal COM Hijacking Persistence
id: 6f3b2c1a-8e9d-4a2b-9c5d-1e0f3a4b5c6d
description: Detects registry modifications associated with Argamal malware persistence via Windows Color System Calibration Loader COM hijacking.
status: experimental
date: 2026/06/06
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/625a3c2d4e1f6b001c8e9d0a
tags:
    - attack.persistence
    - attack.t1546.015
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains: 'CLSID\\{d1e6c267-24c6-4e3d-a4a7-0e0b9736df21}\\InprocServer32'
    condition: selection
falsepositives:
    - Legitimate system calibration software (rare)
level: high
---
title: Suspicious PowerShell Download via Non-Standard Port
description: Detects PowerShell downloading content from IPs or domains on non-standard ports, typical of TDS malware delivery like RemusStealer.
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
date: 2026/06/06
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/625a3c2d4e1f6b001c8e9d0b
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\powershell.exe'
        - Image|endswith: '\pwsh.exe'
    selection_cli:
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'DownloadString'
            - 'IEX'
    selection_port:
        CommandLine|re: ':[0-9]{4,5}/'
    filter_legit:
        CommandLine|contains: 
            - 'windowsupdate.com'
            - 'microsoft.com'
    condition: all of selection_* and not filter_legit
falsepositives:
    - System administration scripts
level: medium
---
title: MacOS ClickFix Terminal Command Execution
description: Detects execution of suspicious shell commands via Terminal often seen in ClickFix campaigns targeting macOS users with fake utility lures.
id: b2c3d4e5-6789-01ab-cdef-234567890abc
status: experimental
date: 2026/06/06
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/625a3c2d4e1f6b001c8e9d0c
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        Image|endswith: '/Terminal.app/Contents/MacOS/Terminal'
        CommandLine|contains:
            - 'curl'
            - 'wget'
            - 'bash -c'
            - 'echo'
    exclusion:
        ParentImage|endswith:
            - '/Xcode.app/'
            - '/Visual Studio Code.app/'
    condition: selection and not exclusion
falsepositives:
    - Legitimate developer activity
level: high

// Hunt for Argamal Persistence Registry Changes
DeviceRegistryEvents
| where ActionType =~ "RegistryValueSet"
| where RegistryKey contains "CLSID" and RegistryKey contains "InprocServer32"
| where RegistryKey contains "d1e6c267-24c6-4e3d-a4a7-0e0b9736df21"
| project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName
;
// Hunt for Network Connections to Malicious IOCs
DeviceNetworkEvents
| where RemoteUrl has_any ("guiformat.com", "forestoaker.com", "jihiz.com", "kayeart.com", "baxe.pics", "asper1.freeddns.org")
  or RemoteIP in ("194.150.220.218", "217.156.122.75")
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName

<#
.SYNOPSIS
    Hunt script for Argamal COM Hijacking artifacts.
.DESCRIPTION
    Checks the registry for the specific InprocServer32 modification used by Argamal.
#>

$Path = "HKLM:\SOFTWARE\Classes\CLSID\{d1e6c267-24c6-4e3d-a4a7-0e0b9736df21}\InprocServer32"
$ExpectedDefault = "%SystemRoot%\system32\mscms.dll"

if (Test-Path $Path) {
    $CurrentValue = (Get-ItemProperty -Path $Path -ErrorAction SilentlyContinue).'(default)'
    
    if ($CurrentValue -ne $ExpectedDefault) {
        Write-Host "[!] ALERT: Potential Argamal COM Hijacking Detected." -ForegroundColor Red
        Write-Host "    Path: $Path"
        Write-Host "    Expected: $ExpectedDefault"
        Write-Host "    Current:  $CurrentValue"
        
        # Check file existence of the payload
        if ($CurrentValue -match "^[a-zA-Z]:\\.+" -and (Test-Path $CurrentValue)) {
            Write-Host "    Payload File Exists: YES"
            $FileHash = Get-FileHash -Path $CurrentValue -Algorithm SHA256
            Write-Host "    Payload Hash: $($FileHash.Hash)"
        }
    } else {
        Write-Host "[+] System Clean: No COM hijacking detected on Windows Color System Calibration Loader." -ForegroundColor Green
    }
} else {
    Write-Host "[?] Registry path not found. System may be clean or using different defaults." -ForegroundColor Yellow
}